Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 82ff7363 authored by Yang Yingliang's avatar Yang Yingliang Committed by Greg Kroah-Hartman
Browse files

mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() 



[ Upstream commit f0f596bd75a9d573ca9b587abb39cee0b916bb82 ]

It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.

skb_queue_purge() is called under spin_lock_irqsave() in hfcpci_l2l1D(),
kfree_skb() is called in it, to fix this, use skb_queue_splice_init()
to move the dch->squeue to a free queue, also enqueue the tx_skb and
rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock.

Fixes: 1700fe1a ("Add mISDN HFC PCI driver")
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: default avatarAlexander Duyck <alexanderduyck@fb.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 5a35d18e

drivers/isdn/hardware/mISDN/hfcpci.c

+9 −4
Original line number Diff line number Diff line
@@ -1617,16 +1617,19 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb) 
		test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);

		spin_lock_irqsave(&hc->lock, flags);

		if (hc->hw.protocol == ISDN_P_NT_S0) {

			struct sk_buff_head free_queue;



			__skb_queue_head_init(&free_queue);

			/* prepare deactivation */

			Write_hfc(hc, HFCPCI_STATES, 0x40);

			skb_queue_purge(&dch->squeue);

			skb_queue_splice_init(&dch->squeue, &free_queue);

			if (dch->tx_skb) {

				dev_kfree_skb(dch->tx_skb);

				__skb_queue_tail(&free_queue, dch->tx_skb);

				dch->tx_skb = NULL;

			}

			dch->tx_idx = 0;

			if (dch->rx_skb) {

				dev_kfree_skb(dch->rx_skb);

				__skb_queue_tail(&free_queue, dch->rx_skb);

				dch->rx_skb = NULL;

			}

			test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
@@ -1639,10 +1642,12 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb) 
			hc->hw.mst_m &= ~HFCPCI_MASTER;

			Write_hfc(hc, HFCPCI_MST_MODE, hc->hw.mst_m);

			ret = 0;

			spin_unlock_irqrestore(&hc->lock, flags);

			__skb_queue_purge(&free_queue);

		} else {

			ret = l1_event(dch->l1, hh->prim);

		}

			spin_unlock_irqrestore(&hc->lock, flags);

		}

		break;

	}

	if (!ret)