Berck E. Nash wrote:

During TX timeout procedure dev could be awoken too early, e.g. by
sky2_complete_tx() called from sky2_down(). Then sky2_xmit_frame()
can run while buffers are freed causing an oops. This patch fixes it
by adding netif_device_present() test in sky2_tx_complete().

Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=14925

With debugging by: Mike McCormack [off-list ref]

Reported-by: Berck E. Nash <redacted>
Tested-by: Berck E. Nash <redacted>
Signed-off-by: Jarek Poplawski <redacted>

---

 drivers/net/sky2.c |    3 ++-

Perhaps only sky2_tx_done should wake the queue?
Does the patch below fix the problem too?

thanks,

Mike



Subject: [PATCH] sky2: Don't wake queue in sky2_tx_complete()

We should only wake the tx queue on completion of
transmits, not after cleaning the tx ring.

Signed-off-by: Mike McCormack <redacted>
---
 drivers/net/sky2.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 93d9635..6d9111d 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c

@@ -1843,9 +1843,6 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
 
 	sky2->tx_cons = idx;
 	smp_mb();
-
-	if (tx_avail(sky2) > MAX_SKB_TX_LE + 4)
-		netif_wake_queue(dev);
 }
 
 static void sky2_tx_reset(struct sky2_hw *hw, unsigned port)

@@ -2416,8 +2413,11 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
 {
 	struct sky2_port *sky2 = netdev_priv(dev);
 
-	if (netif_running(dev))
+	if (netif_running(dev)) {
 		sky2_tx_complete(sky2, last);
+		if (tx_avail(sky2) > MAX_SKB_TX_LE + 4)
+			netif_wake_queue(dev);
+	}
 }
 
 static inline void sky2_skb_rx(const struct sky2_port *sky2,
-- 1.5.6.5