ppp_cp_event is called directly or indirectly by ppp_rx with "ppp->lock" held. It may call mod_timer to add a new timer. However, at the same time ppp_timer may be already running and waiting for "ppp->lock". In this case, there's no need for ppp_timer to continue running and it can just exit. If we let ppp_timer continue running, it may call add_timer. This causes kernel panic because add_timer can't be called with a timer pending. This patch fixes this problem.
Unified · Split
| @@ -569,6 +569,13 @@ static void ppp_timer(struct timer_list *t) · 568 unmodified lines | |||
| 569 | unsigned long flags; | 569 | unsigned long flags; |
| 570 | 570 | ||
| 571 | spin_lock_irqsave(&ppp->lock, flags); | 571 | spin_lock_irqsave(&ppp->lock, flags); |
| 572 | /* mod_timer could be called after we entered this function but | ||
| 573 | * before we got the lock. | ||
| 574 | */ | ||
| 575 | if (timer_pending(&proto->timer)) { | ||
| 576 | spin_unlock_irqrestore(&ppp->lock, flags); | ||
| 577 | return; | ||
| 578 | } | ||
| 572 | switch (proto->state) { | 579 | switch (proto->state) { |
| 573 | case STOPPING: | 580 | case STOPPING: |
| 574 | case REQ_SENT: | 581 | case REQ_SENT: |