Patch "hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()" has been added to the 4.19-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hamradio-don-t-call-dev_kfree_skb-under-spin_lock_ir.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 20f2c94a044322eb11c1208891681414494249ac
Author: Yang Yingliang <yangyingliang@xxxxxxxxxx>
Date:   Thu Dec 8 22:21:46 2022 +0800

    hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
    
    [ Upstream commit 3727f742915f04f6fc550b80cf406999bd4e90d0 ]
    
    It is not allowed to call kfree_skb() or consume_skb() from hardware
    interrupt context or with hardware interrupts being disabled.
    
    It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
    The difference between them is free reason, dev_kfree_skb_irq() means
    the SKB is dropped in error and dev_consume_skb_irq() means the SKB
    is consumed in normal.
    
    In scc_discard_buffers(), dev_kfree_skb() is called to discard the SKBs,
    so replace it with dev_kfree_skb_irq().
    
    In scc_net_tx(), dev_kfree_skb() is called to drop the SKB that exceed
    queue length, so replace it with dev_kfree_skb_irq().
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Yang Yingliang <yangyingliang@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c
index 6c03932d8a6b..3dc4eb841aa1 100644
--- a/drivers/net/hamradio/scc.c
+++ b/drivers/net/hamradio/scc.c
@@ -300,12 +300,12 @@ static inline void scc_discard_buffers(struct scc_channel *scc)
 	spin_lock_irqsave(&scc->lock, flags);	
 	if (scc->tx_buff != NULL)
 	{
-		dev_kfree_skb(scc->tx_buff);
+		dev_kfree_skb_irq(scc->tx_buff);
 		scc->tx_buff = NULL;
 	}
 	
 	while (!skb_queue_empty(&scc->tx_queue))
-		dev_kfree_skb(skb_dequeue(&scc->tx_queue));
+		dev_kfree_skb_irq(skb_dequeue(&scc->tx_queue));
 
 	spin_unlock_irqrestore(&scc->lock, flags);
 }
@@ -1667,7 +1667,7 @@ static netdev_tx_t scc_net_tx(struct sk_buff *skb, struct net_device *dev)
 	if (skb_queue_len(&scc->tx_queue) > scc->dev->tx_queue_len) {
 		struct sk_buff *skb_del;
 		skb_del = skb_dequeue(&scc->tx_queue);
-		dev_kfree_skb(skb_del);
+		dev_kfree_skb_irq(skb_del);
 	}
 	skb_queue_tail(&scc->tx_queue, skb);
 	netif_trans_update(dev);