ppp_cp_event is called directly or indirectly by ppp_rx with "ppp->lock" held. It may call mod_timer to add a new timer. However, at the same time ppp_timer may be already running and waiting for "ppp->lock". In this case, there's no need for ppp_timer to continue running and it can just exit. If we let ppp_timer continue running, it may call add_timer. This causes kernel panic because add_timer can't be called with a timer pending. This patch fixes this problem.
Unified · Split
| @@ -569,6 +569,13 @@ static void ppp_timer(struct timer_list *t) · 568 unmodified lines | ||
| 569 | 569 | unsigned long flags; |
| 570 | 570 | |
| 571 | 571 | spin_lock_irqsave(&ppp->lock, flags); |
| 572 | + /* mod_timer could be called after we entered this function but | |
| 573 | + * before we got the lock. | |
| 574 | + */ | |
| 575 | + if (timer_pending(&proto->timer)) { | |
| 576 | + spin_unlock_irqrestore(&ppp->lock, flags); | |
| 577 | + return; | |
| 578 | + } | |
| 572 | 579 | switch (proto->state) { |
| 573 | 580 | case STOPPING: |
| 574 | 581 | case REQ_SENT: |