Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db77d4d0 authored by Yang Yingliang's avatar Yang Yingliang Committed by Greg Kroah-Hartman
Browse files

mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() 



[ Upstream commit 1232946cf522b8de9e398828bde325d7c41f29dd ]

It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.

skb_queue_purge() is called under spin_lock_irqsave() in handle_dmsg()
and hfcm_l1callback(), kfree_skb() is called in them, to fix this, use
skb_queue_splice_init() to move the dch->squeue to a free queue, also
enqueue the tx_skb and rx_skb, at last calling __skb_queue_purge() to
free the SKBs afer unlock.

Fixes: af69fb3a ("Add mISDN HFC multiport driver")
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: default avatarAlexander Duyck <alexanderduyck@fb.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 82ff7363

drivers/isdn/hardware/mISDN/hfcmulti.c

+13 −6
Original line number Diff line number Diff line
@@ -3219,6 +3219,7 @@ static int 
hfcm_l1callback(struct dchannel *dch, u_int cmd)

{

	struct hfc_multi	*hc = dch->hw;

	struct sk_buff_head	free_queue;

	u_long	flags;



	switch (cmd) {
@@ -3247,6 +3248,7 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd) 
		l1_event(dch->l1, HW_POWERUP_IND);

		break;

	case HW_DEACT_REQ:

		__skb_queue_head_init(&free_queue);

		/* start deactivation */

		spin_lock_irqsave(&hc->lock, flags);

		if (hc->ctype == HFC_TYPE_E1) {
@@ -3266,20 +3268,21 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd) 
				plxsd_checksync(hc, 0);

			}

		}

		skb_queue_purge(&dch->squeue);

		skb_queue_splice_init(&dch->squeue, &free_queue);

		if (dch->tx_skb) {

			dev_kfree_skb(dch->tx_skb);

			__skb_queue_tail(&free_queue, dch->tx_skb);

			dch->tx_skb = NULL;

		}

		dch->tx_idx = 0;

		if (dch->rx_skb) {

			dev_kfree_skb(dch->rx_skb);

			__skb_queue_tail(&free_queue, dch->rx_skb);

			dch->rx_skb = NULL;

		}

		test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);

		if (test_and_clear_bit(FLG_BUSY_TIMER, &dch->Flags))

			del_timer(&dch->timer);

		spin_unlock_irqrestore(&hc->lock, flags);

		__skb_queue_purge(&free_queue);

		break;

	case HW_POWERUP_REQ:

		spin_lock_irqsave(&hc->lock, flags);
@@ -3386,6 +3389,9 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb) 
	case PH_DEACTIVATE_REQ:

		test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);

		if (dch->dev.D.protocol != ISDN_P_TE_S0) {

			struct sk_buff_head free_queue;



			__skb_queue_head_init(&free_queue);

			spin_lock_irqsave(&hc->lock, flags);

			if (debug & DEBUG_HFCMULTI_MSG)

				printk(KERN_DEBUG
@@ -3407,14 +3413,14 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb) 
				/* deactivate */

				dch->state = 1;

			}

			skb_queue_purge(&dch->squeue);

			skb_queue_splice_init(&dch->squeue, &free_queue);

			if (dch->tx_skb) {

				dev_kfree_skb(dch->tx_skb);

				__skb_queue_tail(&free_queue, dch->tx_skb);

				dch->tx_skb = NULL;

			}

			dch->tx_idx = 0;

			if (dch->rx_skb) {

				dev_kfree_skb(dch->rx_skb);

				__skb_queue_tail(&free_queue, dch->rx_skb);

				dch->rx_skb = NULL;

			}

			test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
@@ -3426,6 +3432,7 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb) 
#endif

			ret = 0;

			spin_unlock_irqrestore(&hc->lock, flags);

			__skb_queue_purge(&free_queue);

		} else

			ret = l1_event(dch->l1, hh->prim);

		break;