Patch "mISDN: hfcpci: Fix potential deadlock on &hc->lock" has been added to the 6.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mISDN: hfcpci: Fix potential deadlock on &hc->lock

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     misdn-hfcpci-fix-potential-deadlock-on-hc-lock.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 817526c3b4bcb3489d097635781f450bc77b51f5
Author: Chengfeng Ye <dg573847474@xxxxxxxxx>
Date:   Thu Jul 27 08:56:19 2023 +0000

    mISDN: hfcpci: Fix potential deadlock on &hc->lock
    
    [ Upstream commit 56c6be35fcbed54279df0a2c9e60480a61841d6f ]
    
    As &hc->lock is acquired by both timer _hfcpci_softirq() and hardirq
    hfcpci_int(), the timer should disable irq before lock acquisition
    otherwise deadlock could happen if the timmer is preemtped by the hadr irq.
    
    Possible deadlock scenario:
    hfcpci_softirq() (timer)
        -> _hfcpci_softirq()
        -> spin_lock(&hc->lock);
            <irq interruption>
            -> hfcpci_int()
            -> spin_lock(&hc->lock); (deadlock here)
    
    This flaw was found by an experimental static analysis tool I am developing
    for irq-related deadlock.
    
    The tentative patch fixes the potential deadlock by spin_lock_irq()
    in timer.
    
    Fixes: b36b654a7e82 ("mISDN: Create /sys/class/mISDN")
    Signed-off-by: Chengfeng Ye <dg573847474@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20230727085619.7419-1-dg573847474@xxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index c0331b2680108..fe391de1aba32 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -839,7 +839,7 @@ hfcpci_fill_fifo(struct bchannel *bch)
 		*z1t = cpu_to_le16(new_z1);	/* now send data */
 		if (bch->tx_idx < bch->tx_skb->len)
 			return;
-		dev_kfree_skb(bch->tx_skb);
+		dev_kfree_skb_any(bch->tx_skb);
 		if (get_next_bframe(bch))
 			goto next_t_frame;
 		return;
@@ -895,7 +895,7 @@ hfcpci_fill_fifo(struct bchannel *bch)
 	}
 	bz->za[new_f1].z1 = cpu_to_le16(new_z1);	/* for next buffer */
 	bz->f1 = new_f1;	/* next frame */
-	dev_kfree_skb(bch->tx_skb);
+	dev_kfree_skb_any(bch->tx_skb);
 	get_next_bframe(bch);
 }
 
@@ -1119,7 +1119,7 @@ tx_birq(struct bchannel *bch)
 	if (bch->tx_skb && bch->tx_idx < bch->tx_skb->len)
 		hfcpci_fill_fifo(bch);
 	else {
-		dev_kfree_skb(bch->tx_skb);
+		dev_kfree_skb_any(bch->tx_skb);
 		if (get_next_bframe(bch))
 			hfcpci_fill_fifo(bch);
 	}
@@ -2277,7 +2277,7 @@ _hfcpci_softirq(struct device *dev, void *unused)
 		return 0;
 
 	if (hc->hw.int_m2 & HFCPCI_IRQ_ENABLE) {
-		spin_lock(&hc->lock);
+		spin_lock_irq(&hc->lock);
 		bch = Sel_BCS(hc, hc->hw.bswapped ? 2 : 1);
 		if (bch && bch->state == ISDN_P_B_RAW) { /* B1 rx&tx */
 			main_rec_hfcpci(bch);
@@ -2288,7 +2288,7 @@ _hfcpci_softirq(struct device *dev, void *unused)
 			main_rec_hfcpci(bch);
 			tx_birq(bch);
 		}
-		spin_unlock(&hc->lock);
+		spin_unlock_irq(&hc->lock);
 	}
 	return 0;
 }