[PATCH 0/2] staging: r8188eu: improve error handling

[PATCH 0/2] staging: r8188eu: improve error handling

[Vihas Makwana]

This patchset improves error handling in rtw_init_drv_sw() and
fixes some memory leaks.

Vihas Makwana (2):
  staging: r8188eu: call rtl8188eu_free_recv_priv from
    _rtw_free_recv_priv
  staging: r8188eu: proper error handling in rtw_init_drv_sw

 drivers/staging/r8188eu/core/rtw_recv.c   |  1 +
 drivers/staging/r8188eu/os_dep/os_intfs.c | 60 ++++++++++++++++++-----
 2 files changed, 48 insertions(+), 13 deletions(-)

-- 
2.30.2

[PATCH 1/2] staging: r8188eu: call _cancel_timer_ex from _rtw_free_recv_priv

[Vihas Makwana]

The _rtw_init_recv_priv() initializes precvpriv->signal_stat_timer and
sets it's timeout interval to 1000 ms. But _rtw_free_recv_priv()
doesn't cancel the timer and we need to explicitly call
_cancel_timer_ex() after we call _rtw_free_recv_priv() to cancel the
timer.
Call _cancel_timer_ex() from inside _rtw_free_recv_priv() as every init
function needs a matching free function.


Signed-off-by: Vihas Makwana <makvihas@gmail.com>
---
 drivers/staging/r8188eu/core/rtw_recv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/r8188eu/core/rtw_recv.c b/drivers/staging/r8188eu/core/rtw_recv.c
index d77d98351..61308eb39 100644
--- a/drivers/staging/r8188eu/core/rtw_recv.c
+++ b/drivers/staging/r8188eu/core/rtw_recv.c
@@ -103,6 +103,7 @@ void _rtw_free_recv_priv(struct recv_priv *precvpriv)
 	vfree(precvpriv->pallocated_frame_buf);
 
 	rtl8188eu_free_recv_priv(padapter);
+	_cancel_timer_ex(&precvpriv->signal_stat_timer);
 }
 
 struct recv_frame *_rtw_alloc_recvframe(struct __queue *pfree_recv_queue)
-- 
2.30.2

[PATCH 2/2] staging: r8188eu: proper error handling in rtw_init_drv_sw

[Vihas Makwana]

The code inside rtw_init_drv_sw() calls various init functions to
populate the padapter structure and checks for their return values
respectively.
But if one of the functions in middle fails then it simply returns 
_FAIL instead of proper logging and calling freeing counterparts
of previous init functions.
This leads to various memory leaks and can be found in 
/sys/kernel/debug/kmemleak if kernel is compiled with DEBUG_KMEMLEAK=y.

Fix this and keep the success and error separate.


Signed-off-by: Vihas Makwana <makvihas@gmail.com>
---
Tested on Comfast CF-WU810N RTL8188EUS wireless adapter.
This patch depends on "[PATCH 1/2] staging: r8188eu: call _cancel_timer_ex from
 _rtw_free_recv_priv"
---
 drivers/staging/r8188eu/os_dep/os_intfs.c | 60 ++++++++++++++++++-----
 1 file changed, 47 insertions(+), 13 deletions(-)

diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c
index 197568422..6279bba07 100644
--- a/drivers/staging/r8188eu/os_dep/os_intfs.c
+++ b/drivers/staging/r8188eu/os_dep/os_intfs.c
@@ -469,32 +469,46 @@ u8 rtw_reset_drv_sw(struct adapter *padapter)
 
 u8 rtw_init_drv_sw(struct adapter *padapter)
 {
-	if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL)
+	if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL) {
+		pr_err("rtw_init_cmd_priv failed\n");
 		return _FAIL;
+	}
 
 	padapter->cmdpriv.padapter = padapter;
 
-	if ((rtw_init_evt_priv(&padapter->evtpriv)) == _FAIL)
-		return _FAIL;
+	if ((rtw_init_evt_priv(&padapter->evtpriv)) == _FAIL) {
+		pr_err("rtw_init_evt_priv failed\n");
+		goto free_cmd_priv;
+	}
 
-	if (rtw_init_mlme_priv(padapter) == _FAIL)
-		return _FAIL;
+	if (rtw_init_mlme_priv(padapter) == _FAIL) {
+		pr_err("rtw_init_mlme_priv failed\n");
+		goto free_evt_priv;
+	}
 
 	rtw_init_wifidirect_timers(padapter);
 	init_wifidirect_info(padapter, P2P_ROLE_DISABLE);
 	reset_global_wifidirect_info(padapter);
 
-	if (init_mlme_ext_priv(padapter) == _FAIL)
-		return _FAIL;
+	if (init_mlme_ext_priv(padapter) == _FAIL) {
+		pr_err("init_mlme_ext_priv failed\n");
+		goto free_mlme_priv;
+	}
 
-	if (_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL)
-		return _FAIL;
+	if (_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL) {
+		pr_err("_rtw_init_xmit_priv failed\n");
+		goto free_mlme_ext;
+	}
 
-	if (_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL)
-		return _FAIL;
+	if (_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL) {
+		pr_err("_rtw_init_recv_priv failed\n");
+		goto free_xmit_priv;
+	}
 
-	if (_rtw_init_sta_priv(&padapter->stapriv) == _FAIL)
-		return _FAIL;
+	if (_rtw_init_sta_priv(&padapter->stapriv) == _FAIL) {
+		pr_err("_rtw_init_sta_priv failed\n");
+		goto free_recv_priv;
+	}
 
 	padapter->stapriv.padapter = padapter;
 
@@ -510,6 +524,26 @@ u8 rtw_init_drv_sw(struct adapter *padapter)
 	spin_lock_init(&padapter->br_ext_lock);
 
 	return _SUCCESS;
+
+free_recv_priv:
+	_rtw_free_recv_priv(&padapter->recvpriv);
+
+free_xmit_priv:
+	_rtw_free_xmit_priv(&padapter->xmitpriv);
+
+free_mlme_ext:
+	free_mlme_ext_priv(&padapter->mlmeextpriv);
+
+free_mlme_priv:
+	rtw_free_mlme_priv(&padapter->mlmepriv);
+
+free_evt_priv:
+	rtw_free_evt_priv(&padapter->evtpriv);
+
+free_cmd_priv:
+	rtw_free_cmd_priv(&padapter->cmdpriv);
+
+	return _FAIL;
 }
 
 void rtw_cancel_all_timer(struct adapter *padapter)
-- 
2.30.2

Re: [PATCH 2/2] staging: r8188eu: proper error handling in rtw_init_drv_sw

[Pavel Skripkin]

Hi Vihas,

On 3/8/22 23:55, Vihas Makwana wrote:
> The code inside rtw_init_drv_sw() calls various init functions to
> populate the padapter structure and checks for their return values
> respectively.
> But if one of the functions in middle fails then it simply returns
> _FAIL instead of proper logging and calling freeing counterparts
> of previous init functions.
> This leads to various memory leaks and can be found in
> /sys/kernel/debug/kmemleak if kernel is compiled with DEBUG_KMEMLEAK=y.
> 
> Fix this and keep the success and error separate.
> 
> 
> Signed-off-by: Vihas Makwana <makvihas@gmail.com>
> ---

Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for 
RTL8188eu driver")
> Tested on Comfast CF-WU810N RTL8188EUS wireless adapter.
> This patch depends on "[PATCH 1/2] staging: r8188eu: call _cancel_timer_ex from
>   _rtw_free_recv_priv"
> ---

No need to say that 1/2 depends on 2/2 since they are already in same 
patch series :)

>   drivers/staging/r8188eu/os_dep/os_intfs.c | 60 ++++++++++++++++++-----
>   1 file changed, 47 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c
> index 197568422..6279bba07 100644
> --- a/drivers/staging/r8188eu/os_dep/os_intfs.c
> +++ b/drivers/staging/r8188eu/os_dep/os_intfs.c
> @@ -469,32 +469,46 @@ u8 rtw_reset_drv_sw(struct adapter *padapter)
>   
>   u8 rtw_init_drv_sw(struct adapter *padapter)
>   {
> -	if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL)
> +	if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL) {
> +		pr_err("rtw_init_cmd_priv failed\n");

Hm, what about
dev_err(dvobj_to_dev(padapter->dvobj), "..."); ?

IIRC it's main usb device for this driver.

@Phillip, @Larry, @Martin, please, correct me if I am wrong here


Random note: We can't use netdev_err here since rtw_init_drv_sw() is 
called before netdev registration


>   		return _FAIL;
> +	}
>   
>   	padapter->cmdpriv.padapter = padapter;

Otherwise looks good to me


With regards,
Pavel Skripkin

Re: [PATCH 1/2] staging: r8188eu: call _cancel_timer_ex from _rtw_free_recv_priv

[Dan Carpenter]

On Wed, Mar 09, 2022 at 02:25:09AM +0530, Vihas Makwana wrote:
> The _rtw_init_recv_priv() initializes precvpriv->signal_stat_timer and
> sets it's timeout interval to 1000 ms. But _rtw_free_recv_priv()
> doesn't cancel the timer and we need to explicitly call
> _cancel_timer_ex() after we call _rtw_free_recv_priv() to cancel the
> timer.
> Call _cancel_timer_ex() from inside _rtw_free_recv_priv() as every init
> function needs a matching free function.
> 
> 
> Signed-off-by: Vihas Makwana <makvihas@gmail.com>
> ---
>  drivers/staging/r8188eu/core/rtw_recv.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/staging/r8188eu/core/rtw_recv.c b/drivers/staging/r8188eu/core/rtw_recv.c
> index d77d98351..61308eb39 100644
> --- a/drivers/staging/r8188eu/core/rtw_recv.c
> +++ b/drivers/staging/r8188eu/core/rtw_recv.c
> @@ -103,6 +103,7 @@ void _rtw_free_recv_priv(struct recv_priv *precvpriv)
>  	vfree(precvpriv->pallocated_frame_buf);
>  
>  	rtl8188eu_free_recv_priv(padapter);
> +	_cancel_timer_ex(&precvpriv->signal_stat_timer);
>  }

*If* then timer_setup() belongs in _rtw_init_recv_priv() then this is
where the _cancel_timer_ex() belongs, yes.  But what about if the devs
hid it in a different wrong place?

Right the del_timer is in rtw_cancel_all_timer(), which is called
from rtw_usb_if1_deinit() when we remove the USB device.  So something
more complicated is wrong.  I would prefer to just note this as a bug
until we can investigate more completely.

I believe we can del_timer() twice without creating a bug, but I'm not
positive.

regards,
dan carpenter

Re: [PATCH 2/2] staging: r8188eu: proper error handling in rtw_init_drv_sw

[Dan Carpenter]

On Wed, Mar 09, 2022 at 02:25:10AM +0530, Vihas Makwana wrote:
> The code inside rtw_init_drv_sw() calls various init functions to
> populate the padapter structure and checks for their return values
> respectively.
> But if one of the functions in middle fails then it simply returns 
> _FAIL instead of proper logging and calling freeing counterparts
> of previous init functions.
> This leads to various memory leaks and can be found in 
> /sys/kernel/debug/kmemleak if kernel is compiled with DEBUG_KMEMLEAK=y.
> 
> Fix this and keep the success and error separate.
> 

Delete the extra blank line.  Feel free to add a Fixes tag which points
to the driver add commit.

Looks good.

Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>

> 
> Signed-off-by: Vihas Makwana <makvihas@gmail.com>
> ---
> Tested on Comfast CF-WU810N RTL8188EUS wireless adapter.
> This patch depends on "[PATCH 1/2] staging: r8188eu: call _cancel_timer_ex from
>  _rtw_free_recv_priv"

This is a patchset so that's assumed.  No need to say it.  Also it's not
really true.  Those patches are independent and can be applied in any
order.

regards,
dan carpenter

Re: [PATCH 1/2] staging: r8188eu: call _cancel_timer_ex from _rtw_free_recv_priv

[Vihas Makwana]

> *If* then timer_setup() belongs in _rtw_init_recv_priv() then this is
> where the _cancel_timer_ex() belongs, yes.  But what about if the devs
> hid it in a different wrong place?
>
> Right the del_timer is in rtw_cancel_all_timer(), which is called
> from rtw_usb_if1_deinit() when we remove the USB device.  So something
> more complicated is wrong.  I would prefer to just note this as a bug
> until we can investigate more completely.

Sounds fair.

>
> I believe we can del_timer() twice without creating a bug, but I'm not
> positive.

Yes, we can. I tried it yesterday and it didn't create any bug.

On Wed, Mar 9, 2022 at 1:30 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> On Wed, Mar 09, 2022 at 02:25:09AM +0530, Vihas Makwana wrote:
> > The _rtw_init_recv_priv() initializes precvpriv->signal_stat_timer and
> > sets it's timeout interval to 1000 ms. But _rtw_free_recv_priv()
> > doesn't cancel the timer and we need to explicitly call
> > _cancel_timer_ex() after we call _rtw_free_recv_priv() to cancel the
> > timer.
> > Call _cancel_timer_ex() from inside _rtw_free_recv_priv() as every init
> > function needs a matching free function.
> >
> >
> > Signed-off-by: Vihas Makwana <makvihas@gmail.com>
> > ---
> >  drivers/staging/r8188eu/core/rtw_recv.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/staging/r8188eu/core/rtw_recv.c b/drivers/staging/r8188eu/core/rtw_recv.c
> > index d77d98351..61308eb39 100644
> > --- a/drivers/staging/r8188eu/core/rtw_recv.c
> > +++ b/drivers/staging/r8188eu/core/rtw_recv.c
> > @@ -103,6 +103,7 @@ void _rtw_free_recv_priv(struct recv_priv *precvpriv)
> >       vfree(precvpriv->pallocated_frame_buf);
> >
> >       rtl8188eu_free_recv_priv(padapter);
> > +     _cancel_timer_ex(&precvpriv->signal_stat_timer);
> >  }
>
> *If* then timer_setup() belongs in _rtw_init_recv_priv() then this is
> where the _cancel_timer_ex() belongs, yes.  But what about if the devs
> hid it in a different wrong place?
>
> Right the del_timer is in rtw_cancel_all_timer(), which is called
> from rtw_usb_if1_deinit() when we remove the USB device.  So something
> more complicated is wrong.  I would prefer to just note this as a bug
> until we can investigate more completely.
>
> I believe we can del_timer() twice without creating a bug, but I'm not
> positive.
>
> regards,
> dan carpenter
>


-- 
Thanks,
Vihas