diff mbox

WAN: flush tx_queue in hdlc_ppp to prevent panic on rmmod hw_driver.

Message ID m3mxx5mv8v.fsf@intrepid.localdomain
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Krzysztof Halasa April 15, 2010, 12:09 a.m. UTC
tx_queue is used as a temporary queue when not allowed to queue skb
directly to the hw device driver (which may sleep). Most paths flush
it before returning, but ppp_start() currently cannot. Make sure we
don't leave skbs pointing to a non-existent device.

Thanks to Michael Barkowski for reporting this problem.

Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

David Miller April 16, 2010, 10:41 p.m. UTC | #1
From: Krzysztof Halasa <khc@pm.waw.pl>
Date: Thu, 15 Apr 2010 02:09:52 +0200

> tx_queue is used as a temporary queue when not allowed to queue skb
> directly to the hw device driver (which may sleep). Most paths flush
> it before returning, but ppp_start() currently cannot. Make sure we
> don't leave skbs pointing to a non-existent device.
> 
> Thanks to Michael Barkowski for reporting this problem.
> 
> Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>

Applied, thank you.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Michael Barkowski April 22, 2010, 7:17 p.m. UTC | #2
Krzysztof Halasa wrote:
> tx_queue is used as a temporary queue when not allowed to queue skb
> directly to the hw device driver (which may sleep). Most paths flush
> it before returning, but ppp_start() currently cannot. Make sure we
> don't leave skbs pointing to a non-existent device.
> 
> Thanks to Michael Barkowski for reporting this problem.

Great - thanks.  Will this be going into -stable?
David Miller April 22, 2010, 9:43 p.m. UTC | #3
From: Michael Barkowski <michaelbarkowski@ruggedcom.com>
Date: Thu, 22 Apr 2010 15:17:13 -0400

> Krzysztof Halasa wrote:
>> tx_queue is used as a temporary queue when not allowed to queue skb
>> directly to the hw device driver (which may sleep). Most paths flush
>> it before returning, but ppp_start() currently cannot. Make sure we
>> don't leave skbs pointing to a non-existent device.
>> 
>> Thanks to Michael Barkowski for reporting this problem.
> 
> Great - thanks.  Will this be going into -stable?

When I think it's cooked long enough in Linus's tree and
I submit it there.  That can take a few weeks.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Michael Barkowski April 22, 2010, 9:55 p.m. UTC | #4
David Miller wrote:
> From: Michael Barkowski <michaelbarkowski@ruggedcom.com>
> Date: Thu, 22 Apr 2010 15:17:13 -0400
> 
>> Krzysztof Halasa wrote:
>>> tx_queue is used as a temporary queue when not allowed to queue skb
>>> directly to the hw device driver (which may sleep). Most paths flush
>>> it before returning, but ppp_start() currently cannot. Make sure we
>>> don't leave skbs pointing to a non-existent device.
>>>
>>> Thanks to Michael Barkowski for reporting this problem.
>> Great - thanks.  Will this be going into -stable?
> 
> When I think it's cooked long enough in Linus's tree and
> I submit it there.  That can take a few weeks.
> 

Super.  By the way, should have mentioned - tested and works for me
diff mbox

Patch

diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index b9b9d6b..941f053 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -628,9 +628,15 @@  static void ppp_stop(struct net_device *dev)
 	ppp_cp_event(dev, PID_LCP, STOP, 0, 0, 0, NULL);
 }
 
+static void ppp_close(struct net_device *dev)
+{
+	ppp_tx_flush();
+}
+
 static struct hdlc_proto proto = {
 	.start		= ppp_start,
 	.stop		= ppp_stop,
+	.close		= ppp_close,
 	.type_trans	= ppp_type_trans,
 	.ioctl		= ppp_ioctl,
 	.netif_rx	= ppp_rx,