Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a06393ed authored by Oliver Hartkopp's avatar Oliver Hartkopp Committed by Marc Kleine-Budde
Browse files

can: bcm: fix hrtimer/tasklet termination in bcm op removal 



When removing a bcm tx operation either a hrtimer or a tasklet might run.
As the hrtimer triggers its associated tasklet and vice versa we need to
take care to mutually terminate both handlers.

Reported-by: default avatarMichael Josenhans <michael.josenhans@web.de>
Signed-off-by: default avatarOliver Hartkopp <socketcan@hartkopp.net>
Tested-by: default avatarMichael Josenhans <michael.josenhans@web.de>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent d1156b48

net/can/bcm.c

+16 −7
Original line number Diff line number Diff line
@@ -734,14 +734,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops, 


static void bcm_remove_op(struct bcm_op *op)

{

	if (op->tsklet.func) {

		while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) ||

		       test_bit(TASKLET_STATE_RUN, &op->tsklet.state) ||

		       hrtimer_active(&op->timer)) {

			hrtimer_cancel(&op->timer);

	hrtimer_cancel(&op->thrtimer);



	if (op->tsklet.func)

			tasklet_kill(&op->tsklet);

		}

	}



	if (op->thrtsklet.func)

	if (op->thrtsklet.func) {

		while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) ||

		       test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) ||

		       hrtimer_active(&op->thrtimer)) {

			hrtimer_cancel(&op->thrtimer);

			tasklet_kill(&op->thrtsklet);

		}

	}



	if ((op->frames) && (op->frames != &op->sframe))

		kfree(op->frames);