[PATCH] bnxt: prevent timer rearming during teardown

[Runyu Xiao]

bnxt_timer() checks the interface state before processing timer work, but
the final mod_timer() at bnxt_restart_timer is unconditional. If teardown
clears BNXT_STATE_OPEN while the callback is running, the callback can
rearm the timer after __bnxt_close_nic() has started deleting it.

Check BNXT_STATE_OPEN again before rearming so teardown prevents a callback
already in progress from starting another timer period.

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index d59bcca73..8a2e9e200 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -14484,7 +14484,8 @@ static void bnxt_timer(struct timer_list *t)
 		bnxt_queue_sp_work(bp, BNXT_RING_COAL_NOW_SP_EVENT);
 
 bnxt_restart_timer:
-	mod_timer(&bp->timer, jiffies + bp->current_interval);
+	if (test_bit(BNXT_STATE_OPEN, &bp->state))
+		mod_timer(&bp->timer, jiffies + bp->current_interval);
 }
 
 static void bnxt_lock_sp(struct bnxt *bp)
-- 
2.34.1