[PATCH] bnx2: fix refcount leak in bnx2_change_ring_size()

[Wentao Liang]

The error path in bnx2_change_ring_size() when reopening the
device fails does not balance the intr_sem semaphore.
bnx2_netif_stop(true) increments the semaphore at the start of the
function if the netif is running. On success, bnx2_netif_start(true)
decrements it. However, when bnx2_alloc_mem(), bnx2_request_irq(),
or bnx2_init_nic() fail, the error handling calls bnx2_napi_enable()
and dev_close() without performing the corresponding decrement. This
leaves the semaphore permanently imbalanced, eventually causing
stall or deadlock on subsequent internal synchronization.

Fix this by calling bnx2_netif_start(true) in the error path to
properly release the semaphore count.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 6fefb65e78f0 ("bnx2: Close device if MTU change or ring size change fails.")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/net/ethernet/broadcom/bnx2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index f5722e929833..7f8ade29b7e5 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -7360,6 +7360,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx, bool reset_irq)
 		if (rc) {
 			bnx2_napi_enable(bp);
 			dev_close(bp->dev);
+			atomic_dec(&bp->intr_sem);
 			return rc;
 		}
 #ifdef BCM_CNIC
-- 
2.34.1