net: phy: Fix PHY unbind crash

BugLink: http://bugs.launchpad.net/bugs/1711526
commit 7b9a88a390dacb37b051a7b09b9a08f546edf5eb upstream.

The PHY library does not deal very well with bind and unbind events. The first
thing we would see is that we were not properly canceling the PHY state machine
workqueue, so we would be crashing while dereferencing phydev->drv since there
is no driver attached anymore.

Suggested-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 1d1e5f7723ab88fb8c603490e985424439577ac9..8179727d3423e4f6558f312da18f0dc3fdc477d2 100644 (file)
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1368,6 +1368,8 @@ static int phy_remove(struct device *dev)
 {
        struct phy_device *phydev = to_phy_device(dev);
 
+       cancel_delayed_work_sync(&phydev->state_queue);
+
        mutex_lock(&phydev->lock);
        phydev->state = PHY_DOWN;
        mutex_unlock(&phydev->lock);