net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()

[ Upstream commit 3dfe3486c1cd4f82b466b7d307f23777137b8acc ]

It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.

It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
The difference between them is free reason, dev_kfree_skb_irq() means
the SKB is dropped in error and dev_consume_skb_irq() means the SKB
is consumed in normal.

In this case, dev_kfree_skb() is called in mace_tx_timeout() to drop
the SKB, when tx timeout, so replace it with dev_kfree_skb_irq().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/apple/mace.c b/drivers/net/ethernet/apple/mace.c
index e58a7c73766e9db816a8d4d4dd9d1ed91e39baff..ea6199425b67ca45cf79b21113baf060439152be 100644 (file)
--- a/drivers/net/ethernet/apple/mace.c
+++ b/drivers/net/ethernet/apple/mace.c
@@ -843,7 +843,7 @@ static void mace_tx_timeout(unsigned long data)
     if (mp->tx_bad_runt) {
        mp->tx_bad_runt = 0;
     } else if (i != mp->tx_fill) {
-       dev_kfree_skb(mp->tx_bufs[i]);
+       dev_kfree_skb_irq(mp->tx_bufs[i]);
        if (++i >= N_TX_RING)
            i = 0;
        mp->tx_empty = i;