phylib: convert state_queue work to delayed_work

It closes a race in phy_stop_machine when reprogramming of phy_timer
(from phy_state_machine) happens between del_timer_sync and cancel_work_sync.

Without this change it could lead to crash if phy_device would be freed after
phy_stop_machine (timer would fire and schedule freed work).

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Acked-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 1 insertions, 2 deletions

diff --git a/include/linux/phy.h b/include/linux/phy.h
index d7e54d98869f..32cf14a4b034 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -315,8 +315,7 @@ struct phy_device {
 
         /* Interrupt and Polling infrastructure */
         struct work_struct phy_queue;
-        struct work_struct state_queue;
-        struct timer_list phy_timer;
+        struct delayed_work state_queue;
         atomic_t irq_disable;
 
         struct mutex lock;