From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Thu, 10 Sep 2020 11:05:18 +0200
Subject: s390/qeth: delay draining the TX buffers
Git-commit: 5bf490e6807bf56f49b5991b4be817407dd32656
Patch-mainline: v5.9-rc7
References: git-fixes

Wait until the QDIO data connection is severed. Otherwise the device
might still be processing the buffers, and end up accessing skb data
that we already freed.

Fixes: 8b5026bc1693 ("s390/qeth: fix qdio teardown after early init error")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Petr Tesarik <ptesarik@suse.com>
---
 drivers/s390/net/qeth_l2_main.c |    2 +-
 drivers/s390/net/qeth_l3_main.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -382,7 +382,6 @@ static void qeth_l2_stop_card(struct qet
 		card->state = CARD_STATE_HARDSETUP;
 	}
 	if (card->state == CARD_STATE_HARDSETUP) {
-		qeth_clear_qdio_buffers(card);
 		qeth_clear_working_pool_list(card);
 		card->state = CARD_STATE_DOWN;
 	}
@@ -392,6 +391,7 @@ static void qeth_l2_stop_card(struct qet
 	}
 
 	qeth_qdio_clear_card(card, 0);
+	qeth_clear_qdio_buffers(card);
 	flush_workqueue(card->event_wq);
 	card->info.promisc_mode = 0;
 }
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1426,7 +1426,6 @@ static void qeth_l3_stop_card(struct qet
 		card->state = CARD_STATE_HARDSETUP;
 	}
 	if (card->state == CARD_STATE_HARDSETUP) {
-		qeth_clear_qdio_buffers(card);
 		qeth_clear_working_pool_list(card);
 		card->state = CARD_STATE_DOWN;
 	}
@@ -1436,6 +1435,7 @@ static void qeth_l3_stop_card(struct qet
 	}
 
 	qeth_qdio_clear_card(card, 0);
+	qeth_clear_qdio_buffers(card);
 	flush_workqueue(card->event_wq);
 	card->info.promisc_mode = 0;
 }