leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
0a7dd4e901
linux/drivers/net/wireless/mediatek/mt76
History
Stanislaw Gruszka 8079820177 mt76: usb: fix crash on device removal 
Currently 'while (q->queued > 0)' loop was removed from mt76u_stop_tx()
code. This causes crash on device removal as we try to cleanup empty
queue:

[   96.495571] kernel BUG at include/linux/skbuff.h:2297!
[   96.498983] invalid opcode: 0000 [#1] SMP PTI
[   96.501162] CPU: 3 PID: 27 Comm: kworker/3:0 Not tainted 5.10.0-rc5+ #11
[   96.502754] Hardware name: LENOVO 20DGS08H00/20DGS08H00, BIOS J5ET48WW (1.19 ) 08/27/2015
[   96.504378] Workqueue: usb_hub_wq hub_event
[   96.505983] RIP: 0010:skb_pull+0x2d/0x30
[   96.507576] Code: 00 00 8b 47 70 39 c6 77 1e 29 f0 89 47 70 3b 47 74 72 17 48 8b 87 c8 00 00 00 89 f6 48 01 f0 48 89 87 c8 00 00 00 c3 31 c0 c3 <0f> 0b 90 0f 1f 44 00 00 53 48 89 fb 48 8b bf c8 00 00 00 8b 43 70
[   96.509296] RSP: 0018:ffffb11b801639b8 EFLAGS: 00010287
[   96.511038] RAX: 000000001c6939ed RBX: ffffb11b801639f8 RCX: 0000000000000000
[   96.512964] RDX: ffffb11b801639f8 RSI: 0000000000000018 RDI: ffff90c64e4fb800
[   96.514710] RBP: ffff90c654551ee0 R08: ffff90c652bce7a8 R09: ffffb11b80163728
[   96.516450] R10: 0000000000000001 R11: 0000000000000001 R12: ffff90c64e4fb800
[   96.519749] R13: 0000000000000010 R14: 0000000000000020 R15: ffff90c64e352ce8
[   96.523455] FS:  0000000000000000(0000) GS:ffff90c96eec0000(0000) knlGS:0000000000000000
[   96.527171] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   96.530900] CR2: 0000242556f18288 CR3: 0000000146a10002 CR4: 00000000003706e0
[   96.534678] Call Trace:
[   96.538418]  mt76x02u_tx_complete_skb+0x1f/0x50 [mt76x02_usb]
[   96.542231]  mt76_queue_tx_complete+0x23/0x50 [mt76]
[   96.546028]  mt76u_stop_tx.cold+0x71/0xa2 [mt76_usb]
[   96.549797]  mt76x0u_stop+0x2f/0x90 [mt76x0u]
[   96.553638]  drv_stop+0x33/0xd0 [mac80211]
[   96.557449]  ieee80211_do_stop+0x558/0x860 [mac80211]
[   96.561262]  ? dev_deactivate_many+0x298/0x2d0
[   96.565101]  ieee80211_stop+0x16/0x20 [mac80211]

Fix that by adding while loop again. We need loop, not just single
check, to clean all pending entries.

Additionally move mt76_worker_disable/enable after !mt76_has_tx_pending()
as we want to tx_worker to run to process tx queues, while we wait for
exactly that.

I was a bit worried about accessing q->queued without lock, but
mt76_worker_disable() -> kthread_park() should assure this value will
be seen updated on other cpus.

Fixes: fe5b5ab52e ("mt76: unify queue tx cleanup code")
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201126125520.72912-1-stf_xl@wp.pl
2020-12-02 21:06:10 +02:00
..
mt76x0 mt76: mt76x0: Move tables used only by init.c to their own header file 2020-09-24 18:10:20 +02:00
mt76x2 mt76: convert from tx tasklet to tx worker thread 2020-09-24 18:10:18 +02:00
mt7603 mt76: Convert to DEFINE_SHOW_ATTRIBUTE 2020-09-24 18:10:20 +02:00
mt7615 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-10-05 18:40:01 -07:00
mt7915 wireless-drivers-next patches for v5.10 2020-09-25 13:16:29 -07:00
agg-rx.c mt76: add Rx stats support for radiotap 2020-05-12 19:52:35 +02:00
debugfs.c mt76: remove struct mt76_sw_queue 2020-09-24 18:10:17 +02:00
dma.c mt76: move txwi handling code to dma.c, since it is mmio specific 2020-09-24 18:10:18 +02:00
dma.h
eeprom.c mt76: add API for testmode support 2020-07-21 19:01:15 +02:00
Kconfig mt76: introduce mt76_sdio module 2020-07-21 19:01:18 +02:00
mac80211.c mt76: mt7663s: introduce sdio tx aggregation 2020-09-24 18:10:19 +02:00
Makefile mt76: introduce mt76_sdio module 2020-07-21 19:01:18 +02:00
mcu.c mt76: add headroom and tailroom to mt76_mcu_ops data structure 2020-05-12 19:52:29 +02:00
mmio.c mt76: mt7615: rework IRQ handling to prepare for MSI support 2020-05-12 19:52:31 +02:00
mt76.h mt76: mt7663s: introduce sdio tx aggregation 2020-09-24 18:10:19 +02:00
mt76x02_beacon.c mt76: mt76x02: minor mt76x02_mac_set_beacon optimization 2020-02-14 10:06:02 +01:00
mt76x02_debugfs.c mt76: Convert to DEFINE_SHOW_ATTRIBUTE 2020-09-24 18:10:20 +02:00
mt76x02_dfs.c mt76: Fix unsigned expressions compared with zero 2020-09-24 18:10:20 +02:00
mt76x02_dfs.h
mt76x02_dma.h mt76: convert from tx tasklet to tx worker thread 2020-09-24 18:10:18 +02:00
mt76x02_eeprom.c
mt76x02_eeprom.h
mt76x02_mac.c mt76: Use fallthrough pseudo-keyword 2020-09-24 18:10:19 +02:00
mt76x02_mac.h mt76: remove qid argument to drv->tx_complete_skb 2020-09-24 18:10:17 +02:00
mt76x02_mcu.c mt76: mt76x02: remove check in mt76x02_mcu_msg_send 2020-05-28 17:55:29 +02:00
mt76x02_mcu.h mt76: add headroom and tailroom to mt76_mcu_ops data structure 2020-05-12 19:52:29 +02:00
mt76x02_mmio.c mt76: convert from tx tasklet to tx worker thread 2020-09-24 18:10:18 +02:00
mt76x02_phy.c mt76: move chainmask back to driver specific structs 2020-02-14 10:03:09 +01:00
mt76x02_phy.h mt76: move channel state to struct mt76_phy 2020-02-14 10:03:08 +01:00
mt76x02_regs.h mt76: mt76x02: simplify led reg definitions 2020-02-14 10:06:02 +01:00
mt76x02_trace.c
mt76x02_trace.h mt76: move mac_txdone tracepoint in mt76 module 2020-02-14 10:06:03 +01:00
mt76x02_txrx.c mt76: Introduce mt76_mcu data structure 2020-02-14 10:17:46 +01:00
mt76x02_usb_core.c mt76: move pad estimation out of mt76_skb_adjust_pad 2020-09-24 18:10:19 +02:00
mt76x02_usb_mcu.c mt76: mt76u: add missing release on skb in __mt76x02u_mcu_send_msg 2020-07-21 19:01:19 +02:00
mt76x02_usb.h mt76: remove qid argument to drv->tx_complete_skb 2020-09-24 18:10:17 +02:00
mt76x02_util.c mt76: remove retry_q from struct mt76_txq and related code 2020-09-24 18:10:18 +02:00
mt76x02.h mt76: mt76x02: tune tx ring size 2020-09-24 18:10:17 +02:00
pci.c mt76: fix include in pci.h 2020-07-21 19:01:14 +02:00
sdio.c mt76: move pad estimation out of mt76_skb_adjust_pad 2020-09-24 18:10:19 +02:00
testmode.c mt76: convert from tx tasklet to tx worker thread 2020-09-24 18:10:18 +02:00
testmode.h mt76: add API for testmode support 2020-07-21 19:01:15 +02:00
trace.c mt76: move mac_txdone tracepoint in mt76 module 2020-02-14 10:06:03 +01:00
trace.h mt76: move mac_txdone tracepoint in mt76 module 2020-02-14 10:06:03 +01:00
tx.c mt76: move pad estimation out of mt76_skb_adjust_pad 2020-09-24 18:10:19 +02:00
usb_trace.c
usb_trace.h
usb.c mt76: usb: fix crash on device removal 2020-12-02 21:06:10 +02:00
util.c mt76: add utility functions for deferring work to a kernel thread 2020-09-24 18:10:18 +02:00
util.h mt76: add utility functions for deferring work to a kernel thread 2020-09-24 18:10:18 +02:00