s390/qeth: delay draining the TX buffers

Wait until the QDIO data connection is severed. Otherwise the device
might still be processing the buffers, and end up accessing skb data
that we already freed.

Fixes: 8b5026bc1693 ("s390/qeth: fix qdio teardown after early init error")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 3a94f6c..6384f7a 100644 (file)
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -284,11 +284,11 @@ static void qeth_l2_stop_card(struct qeth_card *card)
 
        if (card->state == CARD_STATE_SOFTSETUP) {
                qeth_clear_ipacmd_list(card);
-               qeth_drain_output_queues(card);
                card->state = CARD_STATE_DOWN;
        }
 
        qeth_qdio_clear_card(card, 0);
+       qeth_drain_output_queues(card);
        qeth_clear_working_pool_list(card);
        flush_workqueue(card->event_wq);
        qeth_flush_local_addrs(card);

diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 4d46196..09ef518 100644 (file)
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1168,11 +1168,11 @@ static void qeth_l3_stop_card(struct qeth_card *card)
        if (card->state == CARD_STATE_SOFTSETUP) {
                qeth_l3_clear_ip_htable(card, 1);
                qeth_clear_ipacmd_list(card);
-               qeth_drain_output_queues(card);
                card->state = CARD_STATE_DOWN;
        }
 
        qeth_qdio_clear_card(card, 0);
+       qeth_drain_output_queues(card);
        qeth_clear_working_pool_list(card);
        flush_workqueue(card->event_wq);
        qeth_flush_local_addrs(card);