From patchwork Wed Aug 23 07:50:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Sascha Hauer X-Patchwork-Id: 136697 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp555029vqm; Wed, 23 Aug 2023 08:59:06 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHdD3pm/ynPzf0e5cbThurTyA1x7BLevw2EX384rW1D6S57kcX9igLFWDBlpQhvz/TxdkMW X-Received: by 2002:a05:6808:dc5:b0:3a8:4dfd:4f0b with SMTP id g5-20020a0568080dc500b003a84dfd4f0bmr12683889oic.19.1692806346436; Wed, 23 Aug 2023 08:59:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692806346; cv=none; d=google.com; s=arc-20160816; b=HSrA4O8H7CupjPj2MDhq8NN2NogNZzHe94ogBFHZjJCAT0uSwTmg+WUQBxLMo+C4r3 nLikNg9uke3jZlsuk9TnyYVtH9GqARh5O7lrkhxqn4TSY3/FGYtdRGF0KeUcUMxkbaIu NchZMamu+WxF16qyxDNJUPUFrwhg1dOvYHDCqZkb00Hj17K2sKBgdaZr8x80wy9gRcJh a1Lz2J02LNkc7Qkfccz/vrh48UH4hwbb4vioZsBrmKhRbrgqFXAgyJTLxXmtrOmJlc+J RKWNnFB4ux9UYd621e/cNCV/TQdVFCBNnqhhK8fUCpI0kBR+2NtVO4KJgBZRfXjmpqPE TOQw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=fNp2x8iw3cPj+TGdfoEfFzVWiC/UXw5A3NBVn2GvokQ=; fh=uih6R3NLjr7WZchszjOPQnRUpzcHYy+gC6FOAyj+yuE=; b=HHhCiJKnbpyFXZUWyRDR5CmO4aDf0cg41kHEMaVBDrkLtrNM5dQ3eqetemnWuZgs53 gEUkNZEy5LER6qCq7tt6hKRu8kI1BSGRg+lm91sfAULwKO0IrGNdIIe3jII5W8z2xl2/ 2UgBu1XvZqQUHEJvPOVvILNGrBQTt1HWpllep2gwrIi/JAbgdvtaTkkXnjW4krXJmFkw jxPC0NyY4Y/hD7shAmTHmKJJMpXM7hEvGz8xsMCwvjd2xdpx7TXjQ6BHW9KTRbIaQx/+ UPvgc7cdb6swEUHcWg2A/6aI/xoDB3ULpM9+y4M0JZgt9+G0dGZQoo1bW8d95ElM1gHA Co2Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d10-20020a630e0a000000b0056399efdbe8si11617645pgl.847.2023.08.23.08.58.52; Wed, 23 Aug 2023 08:59:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231819AbjHWHu2 (ORCPT + 99 others); Wed, 23 Aug 2023 03:50:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48994 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233131AbjHWHu1 (ORCPT ); Wed, 23 Aug 2023 03:50:27 -0400 Received: from metis.ext.pengutronix.de (metis.ext.pengutronix.de [IPv6:2001:67c:670:201:290:27ff:fe1d:cc33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A7DC1CE6 for ; Wed, 23 Aug 2023 00:50:25 -0700 (PDT) Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qYidD-0003sv-Lu; Wed, 23 Aug 2023 09:50:23 +0200 Received: from [2a0a:edc0:0:1101:1d::28] (helo=dude02.red.stw.pengutronix.de) by drehscheibe.grey.stw.pengutronix.de with esmtp (Exim 4.94.2) (envelope-from ) id 1qYidC-000zf6-4f; Wed, 23 Aug 2023 09:50:22 +0200 Received: from sha by dude02.red.stw.pengutronix.de with local (Exim 4.94.2) (envelope-from ) id 1qYidB-002T7g-Dw; Wed, 23 Aug 2023 09:50:21 +0200 From: Sascha Hauer To: linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Ping-Ke Shih , Kalle Valo , =?utf-8?q?Ilgaz_=C3=96cal?= , kernel@pengutronix.de Subject: [PATCH] wifi: rtw88: usb: kill and free rx urbs on probe failure Date: Wed, 23 Aug 2023 09:50:21 +0200 Message-Id: <20230823075021.588596-1-s.hauer@pengutronix.de> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 X-SA-Exim-Connect-IP: 2a0a:edc0:0:c01:1d::a2 X-SA-Exim-Mail-From: sha@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-kernel@vger.kernel.org X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775036107403523016 X-GMAIL-MSGID: 1775036107403523016 After rtw_usb_alloc_rx_bufs() has been called rx urbs have been allocated and must be freed in the error path. After rtw_usb_init_rx() has been called they are submitted, so they also must be killed. Add these forgotten steps to the probe error path. Besides the lost memory this also fixes a problem when the driver fails to download the firmware in rtw_chip_info_setup(). In this case it can happen that the completion of the rx urbs handler runs at a time when we already freed our data structures resulting in a kernel crash. fixes: a82dfd33d1237 ("wifi: rtw88: Add common USB chip support") Cc: stable@vger.kernel.org Reported-by: Ilgaz Öcal Signed-off-by: Sascha Hauer --- drivers/net/wireless/realtek/rtw88/usb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c index 4a57efdba97bb..875a61c9c80d4 100644 --- a/drivers/net/wireless/realtek/rtw88/usb.c +++ b/drivers/net/wireless/realtek/rtw88/usb.c @@ -844,7 +844,7 @@ int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) ret = rtw_core_init(rtwdev); if (ret) - goto err_release_hw; + goto err_free_rx_bufs; ret = rtw_usb_intf_init(rtwdev, intf); if (ret) { @@ -890,6 +890,9 @@ int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) err_deinit_core: rtw_core_deinit(rtwdev); +err_free_rx_bufs: + rtw_usb_free_rx_bufs(rtwusb); + err_release_hw: ieee80211_free_hw(hw);