dahdi_dynamic_eth: Make ztdeth_exit() symetrical with ztdeth_init() and fix race on unload.

Minor change to follow generally recommended practice. Prevents new packets
from being queued up for devices when they are about to be cleaned up. Also
clean up any skbs that may still be on the queue after unloading.

Also closes anoter potential kernel oops on module unload. It was possible to
delete the private structure while the master span process was running. The
result was an attempt to page memory from interrupt context.

Make sure that the pvt function is set and cleared under the zlock. Also do
not assume that the pvt pointer is valid in ztdeth_transmit.

Signed-off-by: Shaun Ruffell <sruffell@digium.com>

git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/trunk@10626 a0bf4364-ded3-4de4-8d8a-66a801d63aff

1 files changed, 9 insertions, 6 deletions

diff --git a/drivers/dahdi/dahdi_dynamic_eth.c b/drivers/dahdi/dahdi_dynamic_eth.c
index 5ad0484..fd3a8cd 100644
--- a/drivers/dahdi/dahdi_dynamic_eth.c
+++ b/drivers/dahdi/dahdi_dynamic_eth.c
@@ -146,7 +146,7 @@ static void ztdeth_transmit(struct dahdi_dynamic *dyn, u8 *msg, size_t msglen)
 
 	spin_lock_irqsave(&zlock, flags);
 	z = dyn->pvt;
-	if (z->dev) {
+	if (z && z->dev) {
 		/* Copy fields to local variables to remove spinlock ASAP */
 		dev = z->dev;
 		memcpy(addr, z->addr, sizeof(z->addr));
@@ -307,11 +307,12 @@ static void ztdeth_destroy(struct dahdi_dynamic *dyn)
 		prev = cur;
 		cur = cur->next;
 	}
-	spin_unlock_irqrestore(&zlock, flags);
 	if (cur == z) {	/* Successfully removed */
+		dyn->pvt = NULL;
 		printk(KERN_INFO "TDMoE: Removed interface for %s\n", z->span->name);
 		kfree(z);
 	}
+	spin_unlock_irqrestore(&zlock, flags);
 }
 
 static int ztdeth_create(struct dahdi_dynamic *dyn, const char *addr)
@@ -434,12 +435,12 @@ static struct notifier_block ztdeth_nblock = {
 
 static int __init ztdeth_init(void)
 {
+	skb_queue_head_init(&skbs);
+
 	dev_add_pack(&ztdeth_ptype);
 	register_netdevice_notifier(&ztdeth_nblock);
 	dahdi_dynamic_register_driver(&ztd_eth);
 
-	skb_queue_head_init(&skbs);
-
 	return 0;
 }
 
@@ -450,9 +451,11 @@ static void __exit ztdeth_exit(void)
 #else
 	cancel_work_sync(&dahdi_dynamic_eth_flush_work);
 #endif
-	dev_remove_pack(&ztdeth_ptype);
-	unregister_netdevice_notifier(&ztdeth_nblock);
 	dahdi_dynamic_unregister_driver(&ztd_eth);
+	unregister_netdevice_notifier(&ztdeth_nblock);
+	dev_remove_pack(&ztdeth_ptype);
+
+	skb_queue_purge(&skbs);
 }
 
 MODULE_DESCRIPTION("DAHDI Dynamic TDMoE Support");