net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()

[ Upstream commit 5fe02e046e6422c4adfdbc50206ec7186077da24 ]

It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.

It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
The difference between them is free reason, dev_kfree_skb_irq() means
the SKB is dropped in error and dev_consume_skb_irq() means the SKB
is consumed in normal.

In this case, dev_kfree_skb() is called in bmac_tx_timeout() to drop
the SKB, when tx timeout, so replace it with dev_kfree_skb_irq().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
index ffa7e7e6d18d04942dbcf987b3ee9eadcf6ec705..01874e1dbb8bbad0f4337a9a5c9c92136fdd0e68 100644 (file)
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -1518,7 +1518,7 @@ static void bmac_tx_timeout(unsigned long data)
        i = bp->tx_empty;
        ++dev->stats.tx_errors;
        if (i != bp->tx_fill) {
-               dev_kfree_skb(bp->tx_bufs[i]);
+               dev_kfree_skb_irq(bp->tx_bufs[i]);
                bp->tx_bufs[i] = NULL;
                if (++i >= N_TX_RING) i = 0;
                bp->tx_empty = i;