[PATCH] 8139too: fix improper usage of workqueue

[PATCH] 8139too: fix improper usage of workqueue

[Stephen Hemminger]

This driver was confused about how workqueue's work. It is save to
schedule multiple times, and the flag (bitfield) was unnecessary and racy.
The workqueue was never canceled either, so it is possible that the thread
could run after driver was removes [OOPS]. As a bonus, get rid the other
wasteful usage of bitfields.

Compile tested only, but based on some internal work done to fix reported
oops.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>


--- a/drivers/net/8139too.c	2008-08-27 08:30:11.000000000 -0700
+++ b/drivers/net/8139too.c	2008-08-27 08:38:18.000000000 -0700
@@ -592,9 +592,8 @@ struct rtl8139_private {
 				/* Twister tune state. */
 	char			twistie, twist_row, twist_col;
 
-	unsigned int		watchdog_fired : 1;
-	unsigned int		default_port : 4; /* Last dev->if_port value. */
-	unsigned int		have_thread : 1;
+	unsigned char		watchdog_fired;
+	unsigned char		default_port; /* Last dev->if_port value. */
 
 	spinlock_t		lock;
 	spinlock_t		rx_lock;
@@ -1614,8 +1613,7 @@ static void rtl8139_thread (struct work_
 	} else
 		rtl8139_thread_iter(dev, tp, tp->mmio_addr);
 
-	if (tp->have_thread)
-		schedule_delayed_work(&tp->thread, thr_delay);
+	schedule_delayed_work(&tp->thread, thr_delay);
 out_unlock:
 	rtnl_unlock ();
 }
@@ -1628,7 +1626,6 @@ static void rtl8139_start_thread(struct 
 	else if (tp->drv_flags & HAS_LNK_CHNG)
 		return;
 
-	tp->have_thread = 1;
 	tp->watchdog_fired = 0;
 
 	schedule_delayed_work(&tp->thread, next_tick);
@@ -1692,10 +1689,8 @@ static void rtl8139_tx_timeout (struct n
 	struct rtl8139_private *tp = netdev_priv(dev);
 
 	tp->watchdog_fired = 1;
-	if (!tp->have_thread) {
-		INIT_DELAYED_WORK(&tp->thread, rtl8139_thread);
-		schedule_delayed_work(&tp->thread, next_tick);
-	}
+
+	schedule_delayed_work(&tp->thread, next_tick);
 }
 
 static int rtl8139_start_xmit (struct sk_buff *skb, struct net_device *dev)
@@ -2217,6 +2212,8 @@ static int rtl8139_close (struct net_dev
 	void __iomem *ioaddr = tp->mmio_addr;
 	unsigned long flags;
 
+	cancel_delayed_work(&tp->thread);
+
 	netif_stop_queue(dev);
 	napi_disable(&tp->napi);
 

Re: [PATCH] 8139too: fix improper usage of workqueue

[Francois Romieu]

Stephen Hemminger <shemminger@vyatta.com> :
> This driver was confused about how workqueue's work. It is save to
> schedule multiple times, and the flag (bitfield) was unnecessary and racy.

static void rtl8139_start_thread(struct rtl8139_private *tp)
{
        tp->twistie = 0;
        if (tp->chipset == CH_8139_K)
                tp->twistie = 1;
        else if (tp->drv_flags & HAS_LNK_CHNG)
                return;
                ^^^^^^^

        tp->have_thread = 1;

The use of the thread was dependent on RTL8129_CAPS. Now it will be
scheduled in the tx_timeout handler for RTL8139_CAPS too.

Speaking of race, the bitfield ('have_thread') is initialized through
rtl8139_open
-> rtl8139_start_thread
Do you mean that the tx_timeout handler can kick before the bitfield
is set ?

> The workqueue was never canceled either, so it is possible that the thread
> could run after driver was removes [OOPS].

The driver uses flush_scheduled_work() when the pci device is removed.

Where would the workqueue be scheduled after / during the removal ?

-- 
Ueimor

Re: [PATCH] 8139too: fix improper usage of workqueue

[Stephen Hemminger]

> The driver uses flush_scheduled_work() when the pci device is removed.
> 
> Where would the workqueue be scheduled after / during the removal ?

The timer can fire after removal causing workqueue to be scheduled.
flush_scheduled_work only impacts work already scheduled not delayed.

How about this (simpler) version.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>

--- a/drivers/net/8139too.c	2008-08-27 08:30:11.000000000 -0700
+++ b/drivers/net/8139too.c	2008-08-27 13:15:06.000000000 -0700
@@ -592,9 +592,9 @@ struct rtl8139_private {
 				/* Twister tune state. */
 	char			twistie, twist_row, twist_col;
 
-	unsigned int		watchdog_fired : 1;
-	unsigned int		default_port : 4; /* Last dev->if_port value. */
-	unsigned int		have_thread : 1;
+	bool			watchdog_fired;
+	bool			have_thread;
+	u8			default_port; /* Last dev->if_port value. */
 
 	spinlock_t		lock;
 	spinlock_t		rx_lock;
@@ -1692,10 +1692,9 @@ static void rtl8139_tx_timeout (struct n
 	struct rtl8139_private *tp = netdev_priv(dev);
 
 	tp->watchdog_fired = 1;
-	if (!tp->have_thread) {
-		INIT_DELAYED_WORK(&tp->thread, rtl8139_thread);
+
+	if (!tp->have_thread)
 		schedule_delayed_work(&tp->thread, next_tick);
-	}
 }
 
 static int rtl8139_start_xmit (struct sk_buff *skb, struct net_device *dev)
@@ -2217,6 +2216,8 @@ static int rtl8139_close (struct net_dev
 	void __iomem *ioaddr = tp->mmio_addr;
 	unsigned long flags;
 
+	cancel_delayed_work(&tp->thread);
+
 	netif_stop_queue(dev);
 	napi_disable(&tp->napi);
 

Re: [PATCH] 8139too: fix improper usage of workqueue

[Francois Romieu]

Stephen Hemminger <shemminger@vyatta.com> :
[...]
> flush_scheduled_work only impacts work already scheduled not delayed.

Ok. I was confused.

> How about this (simpler) version.

Acked-off-by: Francois Romieu <romieu@fr.zoreil.com>

-- 
Ueimor