[PATCH net v2 0/3] mISDN: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[PATCH net v2 0/3] mISDN: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[Yang Yingliang]

It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled. This
pachset try to avoid calling dev_kfree_skb/kfree_skb()() under
spin_lock_irqsave().

v1 -> v2:
  Use skb_queue_splice_init() to move the 'squeue' to a free queue, then purge it.

Yang Yingliang (3):
  mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under
    spin_lock_irqsave()
  mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under
    spin_lock_irqsave()
  mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under
    spin_lock_irqsave()

 drivers/isdn/hardware/mISDN/hfcmulti.c | 19 +++++++++++++------
 drivers/isdn/hardware/mISDN/hfcpci.c   | 13 +++++++++----
 drivers/isdn/hardware/mISDN/hfcsusb.c  | 12 ++++++++----
 3 files changed, 30 insertions(+), 14 deletions(-)

-- 
2.25.1

[PATCH net v2 1/3] mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[Yang Yingliang]

It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.

It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
The difference between them is free reason, dev_kfree_skb_irq() means
the SKB is dropped in error and dev_consume_skb_irq() means the SKB
is consumed in normal.

skb_queue_purge() is called under spin_lock_irqsave() in hfcusb_l2l1D(),
kfree_skb() is called in it, to fix this, use skb_queue_splice_init()
to move the dch->squeue to a free queue, also enqueue the tx_skb and
rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock.

In tx_iso_complete(), dev_kfree_skb() is called to consume the transmitted
SKB, so replace it with dev_consume_skb_irq().

Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
 drivers/isdn/hardware/mISDN/hfcsusb.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index 651f2f8f685b..1efd17979f24 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -326,20 +326,24 @@ hfcusb_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
 		test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
 
 		if (hw->protocol == ISDN_P_NT_S0) {
+			struct sk_buff_head free_queue;
+
+			__skb_queue_head_init(&free_queue);
 			hfcsusb_ph_command(hw, HFC_L1_DEACTIVATE_NT);
 			spin_lock_irqsave(&hw->lock, flags);
-			skb_queue_purge(&dch->squeue);
+			skb_queue_splice_init(&dch->squeue, &free_queue);
 			if (dch->tx_skb) {
-				dev_kfree_skb(dch->tx_skb);
+				__skb_queue_tail(&free_queue, dch->tx_skb);
 				dch->tx_skb = NULL;
 			}
 			dch->tx_idx = 0;
 			if (dch->rx_skb) {
-				dev_kfree_skb(dch->rx_skb);
+				__skb_queue_tail(&free_queue, dch->rx_skb);
 				dch->rx_skb = NULL;
 			}
 			test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
 			spin_unlock_irqrestore(&hw->lock, flags);
+			__skb_queue_purge(&free_queue);
 #ifdef FIXME
 			if (test_and_clear_bit(FLG_L1_BUSY, &dch->Flags))
 				dchannel_sched_event(&hc->dch, D_CLEARBUSY);
@@ -1330,7 +1334,7 @@ tx_iso_complete(struct urb *urb)
 					printk("\n");
 				}
 
-				dev_kfree_skb(tx_skb);
+				dev_consume_skb_irq(tx_skb);
 				tx_skb = NULL;
 				if (fifo->dch && get_next_dframe(fifo->dch))
 					tx_skb = fifo->dch->tx_skb;
-- 
2.25.1

[PATCH net v2 2/3] mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[Yang Yingliang]

It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.

skb_queue_purge() is called under spin_lock_irqsave() in hfcpci_l2l1D(),
kfree_skb() is called in it, to fix this, use skb_queue_splice_init()
to move the dch->squeue to a free queue, also enqueue the tx_skb and
rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock.

Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
 drivers/isdn/hardware/mISDN/hfcpci.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index e964a8dd8512..c0331b268010 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -1617,16 +1617,19 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
 		test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
 		spin_lock_irqsave(&hc->lock, flags);
 		if (hc->hw.protocol == ISDN_P_NT_S0) {
+			struct sk_buff_head free_queue;
+
+			__skb_queue_head_init(&free_queue);
 			/* prepare deactivation */
 			Write_hfc(hc, HFCPCI_STATES, 0x40);
-			skb_queue_purge(&dch->squeue);
+			skb_queue_splice_init(&dch->squeue, &free_queue);
 			if (dch->tx_skb) {
-				dev_kfree_skb(dch->tx_skb);
+				__skb_queue_tail(&free_queue, dch->tx_skb);
 				dch->tx_skb = NULL;
 			}
 			dch->tx_idx = 0;
 			if (dch->rx_skb) {
-				dev_kfree_skb(dch->rx_skb);
+				__skb_queue_tail(&free_queue, dch->rx_skb);
 				dch->rx_skb = NULL;
 			}
 			test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
@@ -1639,10 +1642,12 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
 			hc->hw.mst_m &= ~HFCPCI_MASTER;
 			Write_hfc(hc, HFCPCI_MST_MODE, hc->hw.mst_m);
 			ret = 0;
+			spin_unlock_irqrestore(&hc->lock, flags);
+			__skb_queue_purge(&free_queue);
 		} else {
 			ret = l1_event(dch->l1, hh->prim);
+			spin_unlock_irqrestore(&hc->lock, flags);
 		}
-		spin_unlock_irqrestore(&hc->lock, flags);
 		break;
 	}
 	if (!ret)
-- 
2.25.1

[PATCH net v2 3/3] mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[Yang Yingliang]

It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.

skb_queue_purge() is called under spin_lock_irqsave() in handle_dmsg()
and hfcm_l1callback(), kfree_skb() is called in them, to fix this, use
skb_queue_splice_init() to move the dch->squeue to a free queue, also
enqueue the tx_skb and rx_skb, at last calling __skb_queue_purge() to
free the SKBs afer unlock.

Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
 drivers/isdn/hardware/mISDN/hfcmulti.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 4f7eaa17fb27..e840609c50eb 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -3217,6 +3217,7 @@ static int
 hfcm_l1callback(struct dchannel *dch, u_int cmd)
 {
 	struct hfc_multi	*hc = dch->hw;
+	struct sk_buff_head	free_queue;
 	u_long	flags;
 
 	switch (cmd) {
@@ -3245,6 +3246,7 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd)
 		l1_event(dch->l1, HW_POWERUP_IND);
 		break;
 	case HW_DEACT_REQ:
+		__skb_queue_head_init(&free_queue);
 		/* start deactivation */
 		spin_lock_irqsave(&hc->lock, flags);
 		if (hc->ctype == HFC_TYPE_E1) {
@@ -3264,20 +3266,21 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd)
 				plxsd_checksync(hc, 0);
 			}
 		}
-		skb_queue_purge(&dch->squeue);
+		skb_queue_splice_init(&dch->squeue, &free_queue);
 		if (dch->tx_skb) {
-			dev_kfree_skb(dch->tx_skb);
+			__skb_queue_tail(&free_queue, dch->tx_skb);
 			dch->tx_skb = NULL;
 		}
 		dch->tx_idx = 0;
 		if (dch->rx_skb) {
-			dev_kfree_skb(dch->rx_skb);
+			__skb_queue_tail(&free_queue, dch->rx_skb);
 			dch->rx_skb = NULL;
 		}
 		test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
 		if (test_and_clear_bit(FLG_BUSY_TIMER, &dch->Flags))
 			del_timer(&dch->timer);
 		spin_unlock_irqrestore(&hc->lock, flags);
+		__skb_queue_purge(&free_queue);
 		break;
 	case HW_POWERUP_REQ:
 		spin_lock_irqsave(&hc->lock, flags);
@@ -3384,6 +3387,9 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
 	case PH_DEACTIVATE_REQ:
 		test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
 		if (dch->dev.D.protocol != ISDN_P_TE_S0) {
+			struct sk_buff_head free_queue;
+
+			__skb_queue_head_init(&free_queue);
 			spin_lock_irqsave(&hc->lock, flags);
 			if (debug & DEBUG_HFCMULTI_MSG)
 				printk(KERN_DEBUG
@@ -3405,14 +3411,14 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
 				/* deactivate */
 				dch->state = 1;
 			}
-			skb_queue_purge(&dch->squeue);
+			skb_queue_splice_init(&dch->squeue, &free_queue);
 			if (dch->tx_skb) {
-				dev_kfree_skb(dch->tx_skb);
+				__skb_queue_tail(&free_queue, dch->tx_skb);
 				dch->tx_skb = NULL;
 			}
 			dch->tx_idx = 0;
 			if (dch->rx_skb) {
-				dev_kfree_skb(dch->rx_skb);
+				__skb_queue_tail(&free_queue, dch->rx_skb);
 				dch->rx_skb = NULL;
 			}
 			test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
@@ -3424,6 +3430,7 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
 #endif
 			ret = 0;
 			spin_unlock_irqrestore(&hc->lock, flags);
+			__skb_queue_purge(&free_queue);
 		} else
 			ret = l1_event(dch->l1, hh->prim);
 		break;
-- 
2.25.1

Re: [PATCH net v2 1/3] mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[Alexander H Duyck]

On Mon, 2022-12-12 at 16:41 +0800, Yang Yingliang wrote:
> It is not allowed to call kfree_skb() or consume_skb() from hardware
> interrupt context or with hardware interrupts being disabled.
> 
> It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
> The difference between them is free reason, dev_kfree_skb_irq() means
> the SKB is dropped in error and dev_consume_skb_irq() means the SKB
> is consumed in normal.
> 
> skb_queue_purge() is called under spin_lock_irqsave() in hfcusb_l2l1D(),
> kfree_skb() is called in it, to fix this, use skb_queue_splice_init()
> to move the dch->squeue to a free queue, also enqueue the tx_skb and
> rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock.
> 
> In tx_iso_complete(), dev_kfree_skb() is called to consume the transmitted
> SKB, so replace it with dev_consume_skb_irq().
> 
> Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver")
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> ---
>  drivers/isdn/hardware/mISDN/hfcsusb.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
> index 651f2f8f685b..1efd17979f24 100644
> --- a/drivers/isdn/hardware/mISDN/hfcsusb.c
> +++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
> @@ -326,20 +326,24 @@ hfcusb_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
>  		test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
>  
>  		if (hw->protocol == ISDN_P_NT_S0) {
> +			struct sk_buff_head free_queue;
> +
> +			__skb_queue_head_init(&free_queue);
>  			hfcsusb_ph_command(hw, HFC_L1_DEACTIVATE_NT);
>  			spin_lock_irqsave(&hw->lock, flags);
> -			skb_queue_purge(&dch->squeue);
> +			skb_queue_splice_init(&dch->squeue, &free_queue);
>  			if (dch->tx_skb) {
> -				dev_kfree_skb(dch->tx_skb);
> +				__skb_queue_tail(&free_queue, dch->tx_skb);
>  				dch->tx_skb = NULL;
>  			}
>  			dch->tx_idx = 0;
>  			if (dch->rx_skb) {
> -				dev_kfree_skb(dch->rx_skb);
> +				__skb_queue_tail(&free_queue, dch->rx_skb);
>  				dch->rx_skb = NULL;
>  			}
>  			test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
>  			spin_unlock_irqrestore(&hw->lock, flags);
> +			__skb_queue_purge(&free_queue);
>  #ifdef FIXME
>  			if (test_and_clear_bit(FLG_L1_BUSY, &dch->Flags))
>  				dchannel_sched_event(&hc->dch, D_CLEARBUSY);
> @@ -1330,7 +1334,7 @@ tx_iso_complete(struct urb *urb)
>  					printk("\n");
>  				}
>  
> -				dev_kfree_skb(tx_skb);
> +				dev_consume_skb_irq(tx_skb);
>  				tx_skb = NULL;
>  				if (fifo->dch && get_next_dframe(fifo->dch))
>  					tx_skb = fifo->dch->tx_skb;

Looks good to me.

Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>

Re: [PATCH net v2 2/3] mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[Alexander H Duyck]

On Mon, 2022-12-12 at 16:41 +0800, Yang Yingliang wrote:
> It is not allowed to call kfree_skb() or consume_skb() from hardware
> interrupt context or with hardware interrupts being disabled.
> 
> skb_queue_purge() is called under spin_lock_irqsave() in hfcpci_l2l1D(),
> kfree_skb() is called in it, to fix this, use skb_queue_splice_init()
> to move the dch->squeue to a free queue, also enqueue the tx_skb and
> rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock.
> 
> Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver")
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> ---
>  drivers/isdn/hardware/mISDN/hfcpci.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
> index e964a8dd8512..c0331b268010 100644
> --- a/drivers/isdn/hardware/mISDN/hfcpci.c
> +++ b/drivers/isdn/hardware/mISDN/hfcpci.c
> @@ -1617,16 +1617,19 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
>  		test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
>  		spin_lock_irqsave(&hc->lock, flags);
>  		if (hc->hw.protocol == ISDN_P_NT_S0) {
> +			struct sk_buff_head free_queue;
> +
> +			__skb_queue_head_init(&free_queue);
>  			/* prepare deactivation */
>  			Write_hfc(hc, HFCPCI_STATES, 0x40);
> -			skb_queue_purge(&dch->squeue);
> +			skb_queue_splice_init(&dch->squeue, &free_queue);
>  			if (dch->tx_skb) {
> -				dev_kfree_skb(dch->tx_skb);
> +				__skb_queue_tail(&free_queue, dch->tx_skb);
>  				dch->tx_skb = NULL;
>  			}
>  			dch->tx_idx = 0;
>  			if (dch->rx_skb) {
> -				dev_kfree_skb(dch->rx_skb);
> +				__skb_queue_tail(&free_queue, dch->rx_skb);
>  				dch->rx_skb = NULL;
>  			}
>  			test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
> @@ -1639,10 +1642,12 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
>  			hc->hw.mst_m &= ~HFCPCI_MASTER;
>  			Write_hfc(hc, HFCPCI_MST_MODE, hc->hw.mst_m);
>  			ret = 0;
> +			spin_unlock_irqrestore(&hc->lock, flags);
> +			__skb_queue_purge(&free_queue);
>  		} else {
>  			ret = l1_event(dch->l1, hh->prim);
> +			spin_unlock_irqrestore(&hc->lock, flags);
>  		}
> -		spin_unlock_irqrestore(&hc->lock, flags);
>  		break;
>  	}
>  	if (!ret)

Looks good to me, though I wonder if we couldn't look at moving the
locking so that this code was handled more like patch 3 with the
locking only covering the freeing path instead of also having to wrap
the l1_event.

Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>

Re: [PATCH net v2 3/3] mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[Alexander H Duyck]

On Mon, 2022-12-12 at 16:41 +0800, Yang Yingliang wrote:
> It is not allowed to call kfree_skb() or consume_skb() from hardware
> interrupt context or with hardware interrupts being disabled.
> 
> skb_queue_purge() is called under spin_lock_irqsave() in handle_dmsg()
> and hfcm_l1callback(), kfree_skb() is called in them, to fix this, use
> skb_queue_splice_init() to move the dch->squeue to a free queue, also
> enqueue the tx_skb and rx_skb, at last calling __skb_queue_purge() to
> free the SKBs afer unlock.
> 
> Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> ---
>  drivers/isdn/hardware/mISDN/hfcmulti.c | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
> index 4f7eaa17fb27..e840609c50eb 100644
> --- a/drivers/isdn/hardware/mISDN/hfcmulti.c
> +++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
> @@ -3217,6 +3217,7 @@ static int
>  hfcm_l1callback(struct dchannel *dch, u_int cmd)
>  {
>  	struct hfc_multi	*hc = dch->hw;
> +	struct sk_buff_head	free_queue;
>  	u_long	flags;
>  
>  	switch (cmd) {
> @@ -3245,6 +3246,7 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd)
>  		l1_event(dch->l1, HW_POWERUP_IND);
>  		break;
>  	case HW_DEACT_REQ:
> +		__skb_queue_head_init(&free_queue);
>  		/* start deactivation */
>  		spin_lock_irqsave(&hc->lock, flags);
>  		if (hc->ctype == HFC_TYPE_E1) {
> @@ -3264,20 +3266,21 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd)
>  				plxsd_checksync(hc, 0);
>  			}
>  		}
> -		skb_queue_purge(&dch->squeue);
> +		skb_queue_splice_init(&dch->squeue, &free_queue);
>  		if (dch->tx_skb) {
> -			dev_kfree_skb(dch->tx_skb);
> +			__skb_queue_tail(&free_queue, dch->tx_skb);
>  			dch->tx_skb = NULL;
>  		}
>  		dch->tx_idx = 0;
>  		if (dch->rx_skb) {
> -			dev_kfree_skb(dch->rx_skb);
> +			__skb_queue_tail(&free_queue, dch->rx_skb);
>  			dch->rx_skb = NULL;
>  		}
>  		test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
>  		if (test_and_clear_bit(FLG_BUSY_TIMER, &dch->Flags))
>  			del_timer(&dch->timer);
>  		spin_unlock_irqrestore(&hc->lock, flags);
> +		__skb_queue_purge(&free_queue);
>  		break;
>  	case HW_POWERUP_REQ:
>  		spin_lock_irqsave(&hc->lock, flags);
> @@ -3384,6 +3387,9 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
>  	case PH_DEACTIVATE_REQ:
>  		test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
>  		if (dch->dev.D.protocol != ISDN_P_TE_S0) {
> +			struct sk_buff_head free_queue;
> +
> +			__skb_queue_head_init(&free_queue);
>  			spin_lock_irqsave(&hc->lock, flags);
>  			if (debug & DEBUG_HFCMULTI_MSG)
>  				printk(KERN_DEBUG
> @@ -3405,14 +3411,14 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
>  				/* deactivate */
>  				dch->state = 1;
>  			}
> -			skb_queue_purge(&dch->squeue);
> +			skb_queue_splice_init(&dch->squeue, &free_queue);
>  			if (dch->tx_skb) {
> -				dev_kfree_skb(dch->tx_skb);
> +				__skb_queue_tail(&free_queue, dch->tx_skb);
>  				dch->tx_skb = NULL;
>  			}
>  			dch->tx_idx = 0;
>  			if (dch->rx_skb) {
> -				dev_kfree_skb(dch->rx_skb);
> +				__skb_queue_tail(&free_queue, dch->rx_skb);
>  				dch->rx_skb = NULL;
>  			}
>  			test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
> @@ -3424,6 +3430,7 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
>  #endif
>  			ret = 0;
>  			spin_unlock_irqrestore(&hc->lock, flags);
> +			__skb_queue_purge(&free_queue);
>  		} else
>  			ret = l1_event(dch->l1, hh->prim);
>  		break;

Looks good to me.

Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>

Re: [PATCH net v2 0/3] mISDN: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 12 Dec 2022 16:41:36 +0800 you wrote:
> It is not allowed to call kfree_skb() or consume_skb() from hardware
> interrupt context or with hardware interrupts being disabled. This
> pachset try to avoid calling dev_kfree_skb/kfree_skb()() under
> spin_lock_irqsave().
> 
> v1 -> v2:
>   Use skb_queue_splice_init() to move the 'squeue' to a free queue, then purge it.
> 
> [...]

Here is the summary with links:
  - [net,v2,1/3] mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
    https://git.kernel.org/netdev/net/c/ddc9648db162
  - [net,v2,2/3] mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
    https://git.kernel.org/netdev/net/c/f0f596bd75a9
  - [net,v2,3/3] mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
    https://git.kernel.org/netdev/net/c/1232946cf522

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html