[PATCH] uml: fix net_kern workqueue abuse

Fix up the work on stack and exit scope trouble by placing the work_struct
in the uml_net_private data.

Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

2 files changed, 11 insertions, 6 deletions

diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index b2e9762e13c5..afe3d427ddfa 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@@ -72,9 +72,11 @@ static int uml_net_rx(struct net_device *dev)
         return pkt_len;
 }
 
-static void uml_dev_close(void* dev)
+static void uml_dev_close(struct work_struct *work)
 {
-        dev_close( (struct net_device *) dev);
+        struct uml_net_private *lp =
+                container_of(work, struct uml_net_private, work);
+        dev_close(lp->dev);
 }
 
 irqreturn_t uml_net_interrupt(int irq, void *dev_id)
@@ -89,7 +91,6 @@ irqreturn_t uml_net_interrupt(int irq, void *dev_id)
         spin_lock(&lp->lock);
         while((err = uml_net_rx(dev)) > 0) ;
         if(err < 0) {
-                DECLARE_WORK(close_work, uml_dev_close, dev);
                 printk(KERN_ERR 
                        "Device '%s' read returned %d, shutting it down\n", 
                        dev->name, err);
@@ -97,9 +98,10 @@ irqreturn_t uml_net_interrupt(int irq, void *dev_id)
                  * again lp->lock.
                  * And dev_close() can be safely called multiple times on the
                  * same device, since it tests for (dev->flags & IFF_UP). So
-                 * there's no harm in delaying the device shutdown. */
-                schedule_work(&close_work);
-#error this is not permitted - close_work will go out of scope
+                 * there's no harm in delaying the device shutdown.
+                 * Furthermore, the workqueue will not re-enqueue an already
+                 * enqueued work item. */
+                schedule_work(&lp->work);
                 goto out;
         }
         reactivate_fd(lp->fd, UM_ETH_IRQ);
@@ -365,6 +367,7 @@ static int eth_configure(int n, void *init, char *mac,
         /* This points to the transport private data. It's still clear, but we
          * must memset it to 0 *now*. Let's help the drivers. */
         memset(lp, 0, size);
+        INIT_WORK(&lp->work, uml_dev_close);
 
         /* sysfs register */
         if (!driver_registered) {
diff --git a/arch/um/include/net_kern.h b/arch/um/include/net_kern.h
index 280459fb0b26..218f8b47fdcd 100644
--- a/arch/um/include/net_kern.h
+++ b/arch/um/include/net_kern.h
@@ -11,6 +11,7 @@
 #include <linux/skbuff.h>
 #include <linux/socket.h>
 #include <linux/list.h>
+#include <linux/workqueue.h>
 
 struct uml_net {
         struct list_head list;
@@ -26,6 +27,7 @@ struct uml_net_private {
         struct net_device *dev;
         struct timer_list tl;
         struct net_device_stats stats;
+        struct work_struct work;
         int fd;
         unsigned char mac[ETH_ALEN];
         unsigned short (*protocol)(struct sk_buff *);