| Message ID | 20200902094145.12216-4-luobin9@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | hinic: BugFixes | expand |
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c index a97498ee6914..a0662552a39c 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c @@ -531,6 +531,11 @@ netdev_tx_t hinic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) struct hinic_txq *txq; struct hinic_qp *qp; + if (unlikely(!netif_carrier_ok(netdev))) { + dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + txq = &nic_dev->txqs[q_id]; qp = container_of(txq->sq, struct hinic_qp, sq);
When calling hinic_close in hinic_set_channels, netif_carrier_off and netif_tx_disable are excuted, and TX host resources are freed after that. Core may call hinic_xmit_frame to send pkt after netif_tx_disable within a short time, so we should judge whether carrier is on before sending pkt otherwise the resources that have already been freed in hinic_close may be accessed. Fixes: 2eed5a8b614b ("hinic: add set_channels ethtool_ops support") Signed-off-by: Luo bin <luobin9@huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 5 +++++ 1 file changed, 5 insertions(+)