Patch "ravb: Fix races between ravb_tx_timeout_work() and net related ops" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ravb: Fix races between ravb_tx_timeout_work() and net related ops

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ravb-fix-races-between-ravb_tx_timeout_work-and-net-.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f7d8188ac407ee98c29cca125b821433ed05ffbd
Author: Yoshihiro Shimoda <yoshihiro.shimoda.uh@xxxxxxxxxxx>
Date:   Mon Nov 27 21:24:20 2023 +0900

    ravb: Fix races between ravb_tx_timeout_work() and net related ops
    
    [ Upstream commit 9870257a0a338cd8d6c1cddab74e703f490f6779 ]
    
    Fix races between ravb_tx_timeout_work() and functions of net_device_ops
    and ethtool_ops by using rtnl_trylock() and rtnl_unlock(). Note that
    since ravb_close() is under the rtnl lock and calls cancel_work_sync(),
    ravb_tx_timeout_work() should calls rtnl_trylock(). Otherwise, a deadlock
    may happen in ravb_tx_timeout_work() like below:
    
    CPU0                    CPU1
                            ravb_tx_timeout()
                            schedule_work()
    ...
    __dev_close_many()
    // Under rtnl lock
    ravb_close()
    cancel_work_sync()
    // Waiting
                            ravb_tx_timeout_work()
                            rtnl_lock()
                            // This is possible to cause a deadlock
    
    If rtnl_trylock() fails, rescheduling the work with sleep for 1 msec.
    
    Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
    Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@xxxxxxxxxxx>
    Reviewed-by: Sergey Shtylyov <s.shtylyov@xxxxxx>
    Link: https://lore.kernel.org/r/20231127122420.3706751-1-yoshihiro.shimoda.uh@xxxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 0ef0b88b71459..de12c02c55cbc 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1874,6 +1874,12 @@ static void ravb_tx_timeout_work(struct work_struct *work)
 	struct net_device *ndev = priv->ndev;
 	int error;
 
+	if (!rtnl_trylock()) {
+		usleep_range(1000, 2000);
+		schedule_work(&priv->work);
+		return;
+	}
+
 	netif_tx_stop_all_queues(ndev);
 
 	/* Stop PTP Clock driver */
@@ -1907,7 +1913,7 @@ static void ravb_tx_timeout_work(struct work_struct *work)
 		 */
 		netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n",
 			   __func__, error);
-		return;
+		goto out_unlock;
 	}
 	ravb_emac_init(ndev);
 
@@ -1917,6 +1923,9 @@ static void ravb_tx_timeout_work(struct work_struct *work)
 		ravb_ptp_init(ndev, priv->pdev);
 
 	netif_tx_start_all_queues(ndev);
+
+out_unlock:
+	rtnl_unlock();
 }
 
 /* Packet transmit function for Ethernet AVB */