bnx2fc: fix panic in bnx2fc_post_io_req

System panics while accessing stale pointer - timer_work_queue - in the IO path
before bnx2fc_stop is called. Fix is to destroy the workqueue after the destroy
operation is complete.

Signed-off-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
(cherry picked from commit 2a7b29c5f267c143e280c1a5174a0d930bd6c1e3)

Signed-off-by: Joe Jin <joe.jin@oracle.com>

diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index dda0bca8f107bdd9e7e01d67a0f704a444ee13ce..6e38f63b51246bb04a9ad0cc10220c71aaa2b5eb 100644 (file)
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -1536,6 +1536,7 @@ static void __bnx2fc_destroy(struct bnx2fc_interface *interface)
 static int bnx2fc_destroy(struct net_device *netdev)
 {
        struct bnx2fc_interface *interface = NULL;
+       struct workqueue_struct *timer_work_queue;
        int rc = 0;
 
        rtnl_lock();
@@ -1548,9 +1549,9 @@ static int bnx2fc_destroy(struct net_device *netdev)
                goto netdev_err;
        }
 
-
-       destroy_workqueue(interface->timer_work_queue);
+       timer_work_queue = interface->timer_work_queue;
        __bnx2fc_destroy(interface);
+       destroy_workqueue(timer_work_queue);
 
 netdev_err:
        mutex_unlock(&bnx2fc_dev_lock);