All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Lorenzo Bianconi <lorenzo@kernel.org>,
	Jakub Kicinski <kubakici@wp.pl>,
	Kalle Valo <kvalo@codeaurora.org>
Subject: [PATCH 4.19 17/37] mt7601u: fix kernel crash unplugging the device
Date: Tue,  2 Feb 2021 14:39:00 +0100	[thread overview]
Message-ID: <20210202132943.618246359@linuxfoundation.org> (raw)
In-Reply-To: <20210202132942.915040339@linuxfoundation.org>

From: Lorenzo Bianconi <lorenzo@kernel.org>

commit 0acb20a5438c36e0cf2b8bf255f314b59fcca6ef upstream.

The following crash log can occur unplugging the usb dongle since,
after the urb poison in mt7601u_free_tx_queue(), usb_submit_urb() will
always fail resulting in a skb kfree while the skb has been already
queued.

Fix the issue enqueuing the skb only if usb_submit_urb() succeed.

Hardware name: Hewlett-Packard 500-539ng/2B2C, BIOS 80.06 04/01/2015
Workqueue: usb_hub_wq hub_event
RIP: 0010:skb_trim+0x2c/0x30
RSP: 0000:ffffb4c88005bba8 EFLAGS: 00010206
RAX: 000000004ad483ee RBX: ffff9a236625dee0 RCX: 000000000000662f
RDX: 000000000000000c RSI: 0000000000000000 RDI: ffff9a2343179300
RBP: ffff9a2343179300 R08: 0000000000000001 R09: 0000000000000000
R10: ffff9a23748f7840 R11: 0000000000000001 R12: ffff9a236625e4d4
R13: ffff9a236625dee0 R14: 0000000000001080 R15: 0000000000000008
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd410a34ef8 CR3: 00000001416ee001 CR4: 00000000001706f0
Call Trace:
 mt7601u_tx_status+0x3e/0xa0 [mt7601u]
 mt7601u_dma_cleanup+0xca/0x110 [mt7601u]
 mt7601u_cleanup+0x22/0x30 [mt7601u]
 mt7601u_disconnect+0x22/0x60 [mt7601u]
 usb_unbind_interface+0x8a/0x270
 ? kernfs_find_ns+0x35/0xd0
 __device_release_driver+0x17a/0x230
 device_release_driver+0x24/0x30
 bus_remove_device+0xdb/0x140
 device_del+0x18b/0x430
 ? kobject_put+0x98/0x1d0
 usb_disable_device+0xc6/0x1f0
 usb_disconnect.cold+0x7e/0x20a
 hub_event+0xbf3/0x1870
 process_one_work+0x1b6/0x350
 worker_thread+0x53/0x3e0
 ? process_one_work+0x350/0x350
 kthread+0x11b/0x140
 ? __kthread_bind_mask+0x60/0x60
 ret_from_fork+0x22/0x30

Fixes: 23377c200b2eb ("mt7601u: fix possible memory leak when the device is disconnected")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/3b85219f669a63a8ced1f43686de05915a580489.1610919247.git.lorenzo@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mediatek/mt7601u/dma.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
+++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
@@ -318,7 +318,6 @@ static int mt7601u_dma_submit_tx(struct
 	}
 
 	e = &q->e[q->end];
-	e->skb = skb;
 	usb_fill_bulk_urb(e->urb, usb_dev, snd_pipe, skb->data, skb->len,
 			  mt7601u_complete_tx, q);
 	ret = usb_submit_urb(e->urb, GFP_ATOMIC);
@@ -336,6 +335,7 @@ static int mt7601u_dma_submit_tx(struct
 
 	q->end = (q->end + 1) % q->entries;
 	q->used++;
+	e->skb = skb;
 
 	if (q->used >= q->entries)
 		ieee80211_stop_queue(dev->hw, skb_get_queue_mapping(skb));



  parent reply	other threads:[~2021-02-02 14:58 UTC|newest]

Thread overview: 44+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-02 13:38 [PATCH 4.19 00/37] 4.19.173-rc1 review Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 01/37] nbd: freeze the queue while were adding connections Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 02/37] ACPI: sysfs: Prefer "compatible" modalias Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 03/37] kernel: kexec: remove the lock operation of system_transition_mutex Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 04/37] xen/privcmd: allow fetching resource sizes Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 05/37] ALSA: hda/via: Apply the workaround generically for Clevo machines Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 06/37] media: rc: ensure that uevent can be read directly after rc device register Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 07/37] ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 08/37] wext: fix NULL-ptr-dereference with cfg80211s lack of commit() Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 09/37] net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 10/37] PM: hibernate: flush swap writer after marking Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 11/37] drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 12/37] drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 13/37] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 14/37] KVM: x86: get smi pending status correctly Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 15/37] xen: Fix XenStore initialisation for XS_LOCAL Greg Kroah-Hartman
2021-02-02 13:38 ` [PATCH 4.19 16/37] leds: trigger: fix potential deadlock with libata Greg Kroah-Hartman
2021-02-02 13:39 ` Greg Kroah-Hartman [this message]
2021-02-02 13:39 ` [PATCH 4.19 18/37] mt7601u: fix rx buffer refcounting Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 19/37] xen-blkfront: allow discard-* nodes to be optional Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 20/37] ARM: imx: build suspend-imx6.S with arm instruction set Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 21/37] netfilter: nft_dynset: add timeout extension to template Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 22/37] xfrm: Fix oops in xfrm_replay_advance_bmp Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 23/37] xfrm: fix disable_xfrm sysctl when used on xfrm interfaces Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 24/37] RDMA/cxgb4: Fix the reported max_recv_sge value Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 25/37] pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 26/37] iwlwifi: pcie: use jiffies for memory read spin time limit Greg Kroah-Hartman
2021-02-03 20:42   ` Pavel Machek
2021-02-02 13:39 ` [PATCH 4.19 27/37] iwlwifi: pcie: reschedule in long-running memory reads Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 28/37] mac80211: pause TX while changing interface type Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 29/37] net/mlx5: Fix memory leak on flow table creation error flow Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 30/37] can: dev: prevent potential information leak in can_fill_info() Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 31/37] iommu/vt-d: Gracefully handle DMAR units with no supported address widths Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 32/37] iommu/vt-d: Dont dereference iommu_device if IOMMU_API is not built Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 33/37] rxrpc: Fix memory leak in rxrpc_lookup_local Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 34/37] NFC: fix resource leak when target index is invalid Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 35/37] NFC: fix possible resource leak Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 36/37] team: protect features update by RCU to avoid deadlock Greg Kroah-Hartman
2021-02-02 13:39 ` [PATCH 4.19 37/37] tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN Greg Kroah-Hartman
2021-02-02 17:48 ` [PATCH 4.19 00/37] 4.19.173-rc1 review Pavel Machek
2021-02-02 20:21 ` Jon Hunter
2021-02-03  3:22 ` Naresh Kamboju
2021-02-03 15:42 ` Shuah Khan
2021-02-03 20:42 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210202132943.618246359@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=kubakici@wp.pl \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lorenzo@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.