All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] wifi: mt76: mt7921: correctly handle removal in the absence of firmware
@ 2023-02-21 11:37 Helmut Grohne
  2023-02-22 11:18 ` Lorenzo Bianconi
  0 siblings, 1 reply; 3+ messages in thread
From: Helmut Grohne @ 2023-02-21 11:37 UTC (permalink / raw)
  To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, linux-wireless,
	Stuart Hayhurst
  Cc: Shayne Chen, Sean Wang, Deren Wu, netdev, 1029116

Trying to probe a mt7921e pci card without firmware results in a
successful probe where ieee80211_register_hw hasn't been called. When
removing the driver, ieee802111_unregister_hw is called unconditionally
leading to a kernel NULL pointer dereference among other things.

As with other drivers that delay registration after probe, we track the
registration state in a flag variable and conidtionalize deregistration.

Link: https://bugs.debian.org/1029116
Link: https://bugs.kali.org/view.php?id=8140
Reported-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
Signed-off-by: Helmut Grohne <helmut@freexian.com>
Cc: stable@vger.kernel.org
Sponsored-by: Freexian and Offensive Security
---
 drivers/net/wireless/mediatek/mt76/mt7921/init.c   | 1 +
 drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h | 1 +
 drivers/net/wireless/mediatek/mt76/mt7921/pci.c    | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt7921/sdio.c   | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt7921/usb.c    | 3 ++-
 5 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
index 542dfd425129..d5438212d5ff 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
@@ -315,6 +315,7 @@ static void mt7921_init_work(struct work_struct *work)
 		dev_err(dev->mt76.dev, "register device failed\n");
 		return;
 	}
+	dev->hw_registered = true;
 
 	ret = mt7921_init_debugfs(dev);
 	if (ret) {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
index 15d6b7fe1c6c..e3b5d8ebf243 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
@@ -288,6 +288,7 @@ struct mt7921_dev {
 	bool hw_full_reset:1;
 	bool hw_init_done:1;
 	bool fw_assert:1;
+	bool hw_registered:1;
 
 	struct list_head sta_poll_list;
 	spinlock_t sta_poll_lock;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
index cb72ded37256..1841eb7345dc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
@@ -110,7 +110,8 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev)
 	struct mt76_connac_pm *pm = &dev->pm;
 
 	cancel_work_sync(&dev->init_work);
-	mt76_unregister_device(&dev->mt76);
+	if (dev->hw_registered)
+		mt76_unregister_device(&dev->mt76);
 	mt76_for_each_q_rx(&dev->mt76, i)
 		napi_disable(&dev->mt76.napi[i]);
 	cancel_delayed_work_sync(&pm->ps_work);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
index 8ce4252b8ae7..23a9dd3c6450 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
@@ -43,7 +43,8 @@ static void mt7921s_unregister_device(struct mt7921_dev *dev)
 	struct mt76_connac_pm *pm = &dev->pm;
 
 	cancel_work_sync(&dev->init_work);
-	mt76_unregister_device(&dev->mt76);
+	if (dev->hw_registered)
+		mt76_unregister_device(&dev->mt76);
 	cancel_delayed_work_sync(&pm->ps_work);
 	cancel_work_sync(&pm->wake_work);
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
index 5321d20dcdcb..e55e1b50f760 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
@@ -301,7 +301,8 @@ static void mt7921u_disconnect(struct usb_interface *usb_intf)
 	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
 		return;
 
-	mt76_unregister_device(&dev->mt76);
+	if (dev->hw_registered)
+		mt76_unregister_device(&dev->mt76);
 	mt7921u_cleanup(dev);
 
 	usb_set_intfdata(usb_intf, NULL);
-- 
2.39.0



^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] wifi: mt76: mt7921: correctly handle removal in the absence of firmware
  2023-02-21 11:37 [PATCH] wifi: mt76: mt7921: correctly handle removal in the absence of firmware Helmut Grohne
@ 2023-02-22 11:18 ` Lorenzo Bianconi
  2023-02-22 14:42   ` Helmut Grohne
  0 siblings, 1 reply; 3+ messages in thread
From: Lorenzo Bianconi @ 2023-02-22 11:18 UTC (permalink / raw)
  To: Helmut Grohne, Felix Fietkau, Ryder Lee, linux-wireless,
	Stuart Hayhurst, Shayne Chen, Sean Wang, Deren Wu, netdev,
	1029116

[-- Attachment #1: Type: text/plain, Size: 6190 bytes --]

> Trying to probe a mt7921e pci card without firmware results in a
> successful probe where ieee80211_register_hw hasn't been called. When
> removing the driver, ieee802111_unregister_hw is called unconditionally
> leading to a kernel NULL pointer dereference among other things.
> 
> As with other drivers that delay registration after probe, we track the
> registration state in a flag variable and conidtionalize deregistration.
> 
> Link: https://bugs.debian.org/1029116
> Link: https://bugs.kali.org/view.php?id=8140
> Reported-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
> Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
> Signed-off-by: Helmut Grohne <helmut@freexian.com>
> Cc: stable@vger.kernel.org
> Sponsored-by: Freexian and Offensive Security

Hi Helmut,

Thx for working on this. I would say it is a more general issue since we have
dbdc support in mt7915/mt7996/mt7915 devices. I think we can move the check in
mac80211.c, what do you think? Something like (please note this patch is not
tested):

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index b117e4467c87..34abf70f44af 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -539,6 +539,7 @@ int mt76_register_phy(struct mt76_phy *phy, bool vht,
 	if (ret)
 		return ret;
 
+	set_bit(MT76_STATE_REGISTERED, &phy->state);
 	phy->dev->phys[phy->band_idx] = phy;
 
 	return 0;
@@ -549,6 +550,9 @@ void mt76_unregister_phy(struct mt76_phy *phy)
 {
 	struct mt76_dev *dev = phy->dev;
 
+	if (!test_bit(MT76_STATE_REGISTERED, &phy->state))
+		return;
+
 	if (IS_ENABLED(CONFIG_MT76_LEDS))
 		mt76_led_cleanup(phy);
 	mt76_tx_status_check(dev, true);
@@ -719,6 +723,7 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
 		return ret;
 
 	WARN_ON(mt76_worker_setup(hw, &dev->tx_worker, NULL, "tx"));
+	set_bit(MT76_STATE_REGISTERED, &phy->state);
 	sched_set_fifo_low(dev->tx_worker.task);
 
 	return 0;
@@ -729,6 +734,9 @@ void mt76_unregister_device(struct mt76_dev *dev)
 {
 	struct ieee80211_hw *hw = dev->hw;
 
+	if (!test_bit(MT76_STATE_REGISTERED, &dev->phy.state))
+		return;
+
 	if (IS_ENABLED(CONFIG_MT76_LEDS))
 		mt76_led_cleanup(&dev->phy);
 	mt76_tx_status_check(dev, true);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 4ffb6be63571..38c311760d15 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -402,6 +402,7 @@ struct mt76_tx_cb {
 
 enum {
 	MT76_STATE_INITIALIZED,
+	MT76_STATE_REGISTERED,
 	MT76_STATE_RUNNING,
 	MT76_STATE_MCU_RUNNING,
 	MT76_SCANNING,

Regards,
Lorenzo

> ---
>  drivers/net/wireless/mediatek/mt76/mt7921/init.c   | 1 +
>  drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h | 1 +
>  drivers/net/wireless/mediatek/mt76/mt7921/pci.c    | 3 ++-
>  drivers/net/wireless/mediatek/mt76/mt7921/sdio.c   | 3 ++-
>  drivers/net/wireless/mediatek/mt76/mt7921/usb.c    | 3 ++-
>  5 files changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
> index 542dfd425129..d5438212d5ff 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
> @@ -315,6 +315,7 @@ static void mt7921_init_work(struct work_struct *work)
>  		dev_err(dev->mt76.dev, "register device failed\n");
>  		return;
>  	}
> +	dev->hw_registered = true;
>  
>  	ret = mt7921_init_debugfs(dev);
>  	if (ret) {
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
> index 15d6b7fe1c6c..e3b5d8ebf243 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
> @@ -288,6 +288,7 @@ struct mt7921_dev {
>  	bool hw_full_reset:1;
>  	bool hw_init_done:1;
>  	bool fw_assert:1;
> +	bool hw_registered:1;
>  
>  	struct list_head sta_poll_list;
>  	spinlock_t sta_poll_lock;
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
> index cb72ded37256..1841eb7345dc 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
> @@ -110,7 +110,8 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev)
>  	struct mt76_connac_pm *pm = &dev->pm;
>  
>  	cancel_work_sync(&dev->init_work);
> -	mt76_unregister_device(&dev->mt76);
> +	if (dev->hw_registered)
> +		mt76_unregister_device(&dev->mt76);
>  	mt76_for_each_q_rx(&dev->mt76, i)
>  		napi_disable(&dev->mt76.napi[i]);
>  	cancel_delayed_work_sync(&pm->ps_work);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
> index 8ce4252b8ae7..23a9dd3c6450 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
> @@ -43,7 +43,8 @@ static void mt7921s_unregister_device(struct mt7921_dev *dev)
>  	struct mt76_connac_pm *pm = &dev->pm;
>  
>  	cancel_work_sync(&dev->init_work);
> -	mt76_unregister_device(&dev->mt76);
> +	if (dev->hw_registered)
> +		mt76_unregister_device(&dev->mt76);
>  	cancel_delayed_work_sync(&pm->ps_work);
>  	cancel_work_sync(&pm->wake_work);
>  
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
> index 5321d20dcdcb..e55e1b50f760 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
> @@ -301,7 +301,8 @@ static void mt7921u_disconnect(struct usb_interface *usb_intf)
>  	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
>  		return;
>  
> -	mt76_unregister_device(&dev->mt76);
> +	if (dev->hw_registered)
> +		mt76_unregister_device(&dev->mt76);
>  	mt7921u_cleanup(dev);
>  
>  	usb_set_intfdata(usb_intf, NULL);
> -- 
> 2.39.0
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] wifi: mt76: mt7921: correctly handle removal in the absence of firmware
  2023-02-22 11:18 ` Lorenzo Bianconi
@ 2023-02-22 14:42   ` Helmut Grohne
  0 siblings, 0 replies; 3+ messages in thread
From: Helmut Grohne @ 2023-02-22 14:42 UTC (permalink / raw)
  To: Lorenzo Bianconi
  Cc: Felix Fietkau, Ryder Lee, linux-wireless, Stuart Hayhurst,
	Shayne Chen, Sean Wang, Deren Wu, netdev, 1029116

On Wed, Feb 22, 2023 at 12:18:36PM +0100, Lorenzo Bianconi wrote:
> Thx for working on this. I would say it is a more general issue since we have
> dbdc support in mt7915/mt7996/mt7915 devices. I think we can move the check in
> mac80211.c, what do you think? Something like (please note this patch is not
> tested):

Thanks for looking into this and improving the solution. Your patch
didn't apply cleanly to torvald's master, but it was easy to rebase.

> diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
> index b117e4467c87..34abf70f44af 100644
> --- a/drivers/net/wireless/mediatek/mt76/mac80211.c
> +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
> @@ -539,6 +539,7 @@ int mt76_register_phy(struct mt76_phy *phy, bool vht,
>  	if (ret)
>  		return ret;
>  
> +	set_bit(MT76_STATE_REGISTERED, &phy->state);
>  	phy->dev->phys[phy->band_idx] = phy;
>  
>  	return 0;
> @@ -549,6 +550,9 @@ void mt76_unregister_phy(struct mt76_phy *phy)
>  {
>  	struct mt76_dev *dev = phy->dev;
>  
> +	if (!test_bit(MT76_STATE_REGISTERED, &phy->state))
> +		return;
> +
>  	if (IS_ENABLED(CONFIG_MT76_LEDS))
>  		mt76_led_cleanup(phy);
>  	mt76_tx_status_check(dev, true);
> @@ -719,6 +723,7 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
>  		return ret;
>  
>  	WARN_ON(mt76_worker_setup(hw, &dev->tx_worker, NULL, "tx"));
> +	set_bit(MT76_STATE_REGISTERED, &phy->state);
>  	sched_set_fifo_low(dev->tx_worker.task);
>  
>  	return 0;
> @@ -729,6 +734,9 @@ void mt76_unregister_device(struct mt76_dev *dev)
>  {
>  	struct ieee80211_hw *hw = dev->hw;
>  
> +	if (!test_bit(MT76_STATE_REGISTERED, &dev->phy.state))
> +		return;
> +
>  	if (IS_ENABLED(CONFIG_MT76_LEDS))
>  		mt76_led_cleanup(&dev->phy);
>  	mt76_tx_status_check(dev, true);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
> index 4ffb6be63571..38c311760d15 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76.h
> +++ b/drivers/net/wireless/mediatek/mt76/mt76.h
> @@ -402,6 +402,7 @@ struct mt76_tx_cb {
>  
>  enum {
>  	MT76_STATE_INITIALIZED,
> +	MT76_STATE_REGISTERED,
>  	MT76_STATE_RUNNING,
>  	MT76_STATE_MCU_RUNNING,
>  	MT76_SCANNING,
> 

Tested-by: Helmut Grohne <helmut@freexian.com>

I confirm that it really solves the problem on MT7921 PCIe hardware.

Helmut


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2023-02-22 14:42 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-21 11:37 [PATCH] wifi: mt76: mt7921: correctly handle removal in the absence of firmware Helmut Grohne
2023-02-22 11:18 ` Lorenzo Bianconi
2023-02-22 14:42   ` Helmut Grohne

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.