[RFC PATCH 6.6.y] atm: suni: synchronize poll timer with device removal
From: Hongyan Xu <hidden>
Date: 2026-07-24 05:27:55
Also in:
lkml, stable
Subsystem:
atm, the rest · Maintainers:
Chas Williams, Linus Torvalds
suni_hz() walks the global device list and dereferences each private
structure without taking sunis_lock. suni_stop() can therefore unlink and
free a device while the timer callback is still using it. The existing
timer synchronization only runs for the last device and is performed while
holding sunis_lock.
Protect the callback traversal with sunis_lock. Serialize the first/last
timer transitions with a mutex, unlink under the spinlock, then shut the
timer down outside the spinlock before freeing the last device.
timer_shutdown_sync() also prevents the running callback from rearming
itself; a later first start reinitializes the timer with timer_setup().
Move device initialization before list publication so an existing timer
cannot observe a partially initialized entry.
This driver was removed from mainline by commit 6deb53595092 ("net: remove
unused ATM protocols and legacy ATM device drivers"), but is still present
in the 6.6 LTS series.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Hongyan Xu <redacted>
---
drivers/atm/suni.c | 29 +++++++++++++++++++----------
1 file changed, 19 insertions(+), 10 deletions(-)
diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
index 21e5acc..5fa939b 100644
--- a/drivers/atm/suni.c
+++ b/drivers/atm/suni.c@@ -14,6 +14,7 @@ #include <linux/jiffies.h> #include <linux/kernel.h> #include <linux/mm.h> +#include <linux/mutex.h> #include <linux/errno.h> #include <linux/atmdev.h> #include <linux/sonet.h>
@@ -46,6 +47,7 @@ static struct timer_list poll_timer; static struct suni_priv *sunis = NULL; static DEFINE_SPINLOCK(sunis_lock); +static DEFINE_MUTEX(sunis_mutex); #define ADD_LIMITED(s,v) \
@@ -59,6 +61,7 @@ static void suni_hz(struct timer_list *timer) struct atm_dev *dev; struct k_sonet_stats *stats; + spin_lock_bh(&sunis_lock); for (walk = sunis; walk; walk = walk->next) { dev = walk->dev; stats = &walk->sonet_stats;
@@ -85,6 +88,7 @@ static void suni_hz(struct timer_list *timer) ((GET(TACP_TCC) & 0xff) << 8) | ((GET(TACP_TCCM) & 7) << 16)); } + spin_unlock_bh(&sunis_lock); if (timer) mod_timer(&poll_timer,jiffies+HZ); }
@@ -306,14 +310,9 @@ static void suni_int(struct atm_dev *dev) static int suni_start(struct atm_dev *dev) { - unsigned long flags; int first; - spin_lock_irqsave(&sunis_lock,flags); - first = !sunis; - PRIV(dev)->next = sunis; - sunis = PRIV(dev); - spin_unlock_irqrestore(&sunis_lock,flags); + mutex_lock(&sunis_mutex); memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats)); PUT(GET(RSOP_CIE) | SUNI_RSOP_CIE_LOSE,RSOP_CIE); /* interrupt on loss of signal */
@@ -322,6 +321,11 @@ static int suni_start(struct atm_dev *dev) printk(KERN_WARNING "%s(itf %d): no signal\n",dev->type, dev->number); PRIV(dev)->loop_mode = ATM_LM_NONE; + spin_lock_bh(&sunis_lock); + first = !sunis; + PRIV(dev)->next = sunis; + sunis = PRIV(dev); + spin_unlock_bh(&sunis_lock); suni_hz(NULL); /* clear SUNI counters */ (void) fetch_stats(dev,NULL,1); /* clear kernel counters */ if (first) {
@@ -333,6 +337,7 @@ printk(KERN_DEBUG "[u] p=0x%lx,n=0x%lx\n",(unsigned long) poll_timer.list.prev, #endif add_timer(&poll_timer); } + mutex_unlock(&sunis_mutex); return 0; }
@@ -340,16 +345,20 @@ printk(KERN_DEBUG "[u] p=0x%lx,n=0x%lx\n",(unsigned long) poll_timer.list.prev, static int suni_stop(struct atm_dev *dev) { struct suni_priv **walk; - unsigned long flags; + bool last; /* let SAR driver worry about stopping interrupts */ - spin_lock_irqsave(&sunis_lock,flags); + mutex_lock(&sunis_mutex); + spin_lock_bh(&sunis_lock); for (walk = &sunis; *walk != PRIV(dev); walk = &PRIV((*walk)->dev)->next); *walk = PRIV((*walk)->dev)->next; - if (!sunis) del_timer_sync(&poll_timer); - spin_unlock_irqrestore(&sunis_lock,flags); + last = !sunis; + spin_unlock_bh(&sunis_lock); + if (last) + timer_shutdown_sync(&poll_timer); kfree(PRIV(dev)); + mutex_unlock(&sunis_mutex); return 0; }
--
2.50.1.windows.1