PLIP interrupt, transmit, and work paths schedule the immediate and deferred work items embedded in netdev private state. plip_close() stops IRQ or polling publication, but it releases the parport and pending skbs without draining those work items first. A callback can therefore continue using resources released by an ordinary interface close or device teardown. Initialize both work items disabled. On open, reset protocol state before enabling the work and its IRQ or polling publishers. On close, stop those publishers and then disable and drain the work before releasing resources. The balanced enable and disable operations support later interface reopen. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hongyan Xu --- drivers/net/plip/plip.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/drivers/net/plip/plip.c b/drivers/net/plip/plip.c index d81163bc910a..97bbac0b95da 100644 --- a/drivers/net/plip/plip.c +++ b/drivers/net/plip/plip.c @@ -308,6 +308,8 @@ plip_init_netdev(struct net_device *dev) /* Initialize task queue structures */ INIT_WORK(&nl->immediate, plip_bh); INIT_DELAYED_WORK(&nl->deferred, plip_kick_bh); + disable_work(&nl->immediate); + disable_delayed_work(&nl->deferred); if (dev->irq == -1) INIT_DELAYED_WORK(&nl->timer, plip_timer_bh); @@ -1077,6 +1079,17 @@ plip_open(struct net_device *dev) nl->should_relinquish = 0; + /* Initialize the state machine. */ + nl->rcv_data.state = PLIP_PK_DONE; + nl->snd_data.state = PLIP_PK_DONE; + nl->rcv_data.skb = NULL; + nl->snd_data.skb = NULL; + nl->connection = PLIP_CN_NONE; + nl->is_deferred = 0; + + enable_work(&nl->immediate); + enable_work(&nl->deferred.work); + /* Clear the data port. */ write_data (dev, 0x00); @@ -1088,12 +1101,6 @@ plip_open(struct net_device *dev) schedule_delayed_work(&nl->timer, 1); } - /* Initialize the state machine. */ - nl->rcv_data.state = nl->snd_data.state = PLIP_PK_DONE; - nl->rcv_data.skb = nl->snd_data.skb = NULL; - nl->connection = PLIP_CN_NONE; - nl->is_deferred = 0; - /* Fill in the MAC-level header. We used to abuse dev->broadcast to store the point-to-point MAC address, but we no longer do it. Instead, we fetch the @@ -1141,6 +1148,9 @@ plip_close(struct net_device *dev) wait_for_completion(&nl->killed_timer_cmp); } + disable_work_sync(&nl->immediate); + disable_delayed_work_sync(&nl->deferred); + #ifdef NOTDEF outb(0x00, PAR_DATA(dev)); #endif -- 2.50.1.windows.1