From: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
To: linux-wireless@vger.kernel.org
Cc: brcm80211-dev-list@broadcom.com, brcm80211-dev-list@cypress.com,
Arend van Spriel <arend.vanspriel@broadcom.com>,
Franky Lin <franky.lin@broadcom.com>,
Hante Meuleman <hante.meuleman@broadcom.com>,
Wright Feng <wright.feng@cypress.com>,
Kalle Valo <kvalo@codeaurora.org>,
Raveendran Somu <raveendran.somu@cypress.com>,
Chi-hsien Lin <chi-hsien.lin@cypress.com>
Subject: [PATCH V2 1/6] brcmfmac: Fix driver crash on USB control transfer timeout
Date: Fri, 13 Mar 2020 05:50:15 -0500 [thread overview]
Message-ID: <1584096620-101123-2-git-send-email-chi-hsien.lin@cypress.com> (raw)
In-Reply-To: <1584096620-101123-1-git-send-email-chi-hsien.lin@cypress.com>
From: Raveendran Somu <raveendran.somu@cypress.com>
When the control transfer gets timed out, the error status
was returned without killing that urb, this leads to using
the same urb. This issue causes the kernel crash as the same
urb is sumbitted multiple times. The fix is to kill the
urb for timeout transfer before returning error
Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
index 575ed19e9195..10387a7f5d56 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -328,11 +328,12 @@ static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
return err;
}
timeout = brcmf_usb_ioctl_resp_wait(devinfo);
- clear_bit(0, &devinfo->ctl_op);
if (!timeout) {
brcmf_err("Txctl wait timed out\n");
+ usb_kill_urb(devinfo->ctl_urb);
err = -EIO;
}
+ clear_bit(0, &devinfo->ctl_op);
return err;
}
@@ -358,11 +359,12 @@ static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
}
timeout = brcmf_usb_ioctl_resp_wait(devinfo);
err = devinfo->ctl_urb_status;
- clear_bit(0, &devinfo->ctl_op);
if (!timeout) {
brcmf_err("rxctl wait timed out\n");
+ usb_kill_urb(devinfo->ctl_urb);
err = -EIO;
}
+ clear_bit(0, &devinfo->ctl_op);
if (!err)
return devinfo->ctl_urb_actual_length;
else
--
2.1.0
next prev parent reply other threads:[~2020-03-13 10:51 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-13 10:50 [PATCH V2 0/6] brcmfmac: USB change series Chi-Hsien Lin
2020-03-13 10:50 ` Chi-Hsien Lin [this message]
2020-03-23 17:32 ` [PATCH V2 1/6] brcmfmac: Fix driver crash on USB control transfer timeout Kalle Valo
2020-03-13 10:50 ` [PATCH V2 2/6] brcmfmac: Fix double freeing in the fmac usb data path Chi-Hsien Lin
2020-03-13 10:50 ` [PATCH V2 3/6] brcmfmac: fix the incorrect return value in brcmf_inform_single_bss() Chi-Hsien Lin
2020-03-13 10:50 ` [PATCH V2 4/6] brcmfmac: increase max hanger slots from 1K to 3K in fws layer Chi-Hsien Lin
2020-03-13 10:50 ` [PATCH V2 5/6] brcmfmac: add USB autosuspend feature support Chi-Hsien Lin
2020-03-13 10:50 ` [PATCH V2 6/6] brcmfmac: To support printing USB console messages Chi-Hsien Lin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1584096620-101123-2-git-send-email-chi-hsien.lin@cypress.com \
--to=chi-hsien.lin@cypress.com \
--cc=arend.vanspriel@broadcom.com \
--cc=brcm80211-dev-list@broadcom.com \
--cc=brcm80211-dev-list@cypress.com \
--cc=franky.lin@broadcom.com \
--cc=hante.meuleman@broadcom.com \
--cc=kvalo@codeaurora.org \
--cc=linux-wireless@vger.kernel.org \
--cc=raveendran.somu@cypress.com \
--cc=wright.feng@cypress.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.