[RFC PATCH 6.6.y] atm: he: kill tasklet before releasing queues

[Hongyan Xu]

The interrupt handler schedules a tasklet which accesses the device queues.
tasklet_disable() waits for a running instance, but leaves a scheduled
instance pending while he_stop() releases those queues and the device.

After masking device interrupts, unregister the IRQ so the handler can no
longer schedule the tasklet, then kill the tasklet before releasing any of
its data.

The affected driver was removed upstream by commit 6deb53595092 ("net:
remove unused ATM protocols and legacy ATM device drivers").  This change
is intended for maintained stable kernels which still carry the driver.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hongyan Xu <getshell@xxxxxxxxxx>
---
 drivers/atm/he.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 92a041d..6b2c795 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -1536,9 +1536,13 @@ he_stop(struct he_dev *he_dev)
 		pci_read_config_dword(pci_dev, GEN_CNTL_0, &gen_cntl_0);
 		gen_cntl_0 &= ~(INT_PROC_ENBL | INIT_ENB);
 		pci_write_config_dword(pci_dev, GEN_CNTL_0, gen_cntl_0);
+	}
 
-		tasklet_disable(&he_dev->tasklet);
+	if (he_dev->irq)
+		free_irq(he_dev->irq, he_dev);
+	tasklet_kill(&he_dev->tasklet);
 
+	if (he_dev->membase) {
 		/* disable recv and transmit */
 
 		reg = he_readl_mbox(he_dev, CS_ERCTL0);
@@ -1555,9 +1559,6 @@ he_stop(struct he_dev *he_dev)
 		he_dev->atm_dev->phy->stop(he_dev->atm_dev);
 #endif /* CONFIG_ATM_HE_USE_SUNI */
 
-	if (he_dev->irq)
-		free_irq(he_dev->irq, he_dev);
-
 	if (he_dev->irq_base)
 		dma_free_coherent(&he_dev->pci_dev->dev, (CONFIG_IRQ_SIZE + 1)
 				  * sizeof(struct he_irq), he_dev->irq_base, he_dev->irq_phys);
-- 
2.50.1.windows.1