Patch "tg3: Fix race condition in tg3_get_stats64()." has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

tg3: Fix race condition in tg3_get_stats64().

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:

     tg3-fix-race-condition-in-tg3_get_stats64.patch

and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Michael Chan <[email protected]>
Date: Fri, 6 Jan 2017 16:18:53 -0500
Subject: tg3: Fix race condition in tg3_get_stats64().

From: Michael Chan <[email protected]>

[ Upstream commit f5992b72ebe0dde488fa8f706b887194020c66fc ]

The driver's ndo_get_stats64() method is not always called under RTNL. So it can race with driver close or ethtool reconfigurations. Fix the race condition by taking tp->lock spinlock in tg3_free_consistent() when freeing the tp->hw_stats memory block. tg3_get_stats64() is already taking tp->lock.

---
 drivers/net/ethernet/broadcom/tg3.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -8705,11 +8705,14 @@ static void tg3_free_consistent(struct t
 	tg3_mem_rx_release(tp);
 	tg3_mem_tx_release(tp);
 
+	/* Protect tg3_get_stats64() from reading freed tp->hw_stats. */
+	tg3_full_lock(tp, 0);
 	if (tp->hw_stats) {
 		dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats),
 				  tp->hw_stats, tp->stats_mapping);
 		tp->hw_stats = NULL;
 	}
+	tg3_full_unlock(tp);
 }
 
 /*

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/tg3-fix-race-condition-in-tg3_get_stats64.patch