From da4e121e1dca03dcd550e449254c8cd745b2ec62 Mon Sep 17 00:00:00 2001 From: Taylor R Campbell Date: Sat, 25 Dec 2021 12:31:44 +0000 Subject: [PATCH] mii(9): Fix callout race between mii_phy_down and mii_phy_detach. --- sys/dev/mii/mii_physubr.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/sys/dev/mii/mii_physubr.c b/sys/dev/mii/mii_physubr.c index 06925d5c96cb..62714cc7b0d2 100644 --- a/sys/dev/mii/mii_physubr.c +++ b/sys/dev/mii/mii_physubr.c @@ -429,8 +429,20 @@ mii_phy_down(struct mii_softc *sc) KASSERT(mii_locked(sc->mii_pdata)); if (sc->mii_flags & MIIF_DOINGAUTO) { - sc->mii_flags &= ~MIIF_DOINGAUTO; - callout_stop(&sc->mii_nway_ch); + /* + * Try to stop it. + * + * - If we stopped it before it expired, callout_stop + * returns 0, and it is our responsibility to clear + * MIIF_DOINGAUTO. + * + * - Otherwise, we're too late -- the callout has + * already begun, and we must leave MIIF_DOINGAUTO + * set so mii_phy_detach will wait for it to + * complete. + */ + if (!callout_stop(&sc->mii_nway_ch)) + sc->mii_flags &= ~MIIF_DOINGAUTO; } }