From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Tue, 10 Mar 2020 18:38:03 +0100
Subject: s390/qeth: cancel RX reclaim work earlier
Git-commit: 0e635c2a8713e3e013b4adcb7cb7e28a048b7c42
Patch-mainline: v5.6-rc6
References: git-fixes

When qeth's napi poll code fails to refill an entirely empty RX ring, it
kicks off buffer_reclaim_work to try again later.

Make sure that this worker is cancelled when setting the qeth device
offline. Otherwise a RX refill action can unexpectedly end up running
concurrently to bigger re-configurations (eg. resizing the buffer pool),
without any locking.

Fixes: b333293058aa ("qeth: add support for af_iucv HiperSockets transport")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Petr Tesarik <ptesarik@suse.com>
---
 drivers/s390/net/qeth_core_main.c |    1 -
 drivers/s390/net/qeth_l2_main.c   |    1 +
 drivers/s390/net/qeth_l3_main.c   |    1 +
 3 files changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2593,7 +2593,6 @@ static void qeth_free_qdio_buffers(struc
 		return;
 
 	qeth_free_cq(card);
-	cancel_delayed_work_sync(&card->buffer_reclaim_work);
 	for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) {
 		if (card->qdio.in_q->bufs[j].rx_skb)
 			dev_kfree_skb_any(card->qdio.in_q->bufs[j].rx_skb);
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -435,6 +435,7 @@ static void qeth_l2_stop_card(struct qet
 	if (card->state == CARD_STATE_HARDSETUP) {
 		qeth_clear_qdio_buffers(card);
 		qeth_clear_working_pool_list(card);
+		cancel_delayed_work_sync(&card->buffer_reclaim_work);
 		card->state = CARD_STATE_DOWN;
 	}
 	if (card->state == CARD_STATE_DOWN) {
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1904,6 +1904,7 @@ static void qeth_l3_stop_card(struct qet
 	if (card->state == CARD_STATE_HARDSETUP) {
 		qeth_clear_qdio_buffers(card);
 		qeth_clear_working_pool_list(card);
+		cancel_delayed_work_sync(&card->buffer_reclaim_work);
 		card->state = CARD_STATE_DOWN;
 	}
 	if (card->state == CARD_STATE_DOWN) {