From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Raveendran Somu <raveendran.somu@cypress.com>,
Chi-hsien Lin <chi-hsien.lin@cypress.com>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>,
linux-wireless@vger.kernel.org,
brcm80211-dev-list.pdl@broadcom.com,
brcm80211-dev-list@cypress.com, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.5 089/121] brcmfmac: Fix driver crash on USB control transfer timeout
Date: Sat, 11 Apr 2020 19:06:34 -0400 [thread overview]
Message-ID: <20200411230706.23855-89-sashal@kernel.org> (raw)
In-Reply-To: <20200411230706.23855-1-sashal@kernel.org>
From: Raveendran Somu <raveendran.somu@cypress.com>
[ Upstream commit 93a5bfbc7cad8bf3dea81c9bc07761c1226a0860 ]
When the control transfer gets timed out, the error status
was returned without killing that urb, this leads to using
the same urb. This issue causes the kernel crash as the same
urb is sumbitted multiple times. The fix is to kill the
urb for timeout transfer before returning error
Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1585124429-97371-2-git-send-email-chi-hsien.lin@cypress.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
index 575ed19e91951..10387a7f5d565 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -328,11 +328,12 @@ static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
return err;
}
timeout = brcmf_usb_ioctl_resp_wait(devinfo);
- clear_bit(0, &devinfo->ctl_op);
if (!timeout) {
brcmf_err("Txctl wait timed out\n");
+ usb_kill_urb(devinfo->ctl_urb);
err = -EIO;
}
+ clear_bit(0, &devinfo->ctl_op);
return err;
}
@@ -358,11 +359,12 @@ static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
}
timeout = brcmf_usb_ioctl_resp_wait(devinfo);
err = devinfo->ctl_urb_status;
- clear_bit(0, &devinfo->ctl_op);
if (!timeout) {
brcmf_err("rxctl wait timed out\n");
+ usb_kill_urb(devinfo->ctl_urb);
err = -EIO;
}
+ clear_bit(0, &devinfo->ctl_op);
if (!err)
return devinfo->ctl_urb_actual_length;
else
--
2.20.1
next prev parent reply other threads:[~2020-04-11 23:35 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-11 23:05 [PATCH AUTOSEL 5.5 001/121] net: wan: wanxl: use allow to pass CROSS_COMPILE_M68k for rebuilding firmware Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 002/121] netfilter: ctnetlink: be more strict when NF_CONNTRACK_MARK is not set Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 003/121] net: axienet: Convert DMA error handler to a work queue Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 004/121] net: phy: probe PHY drivers synchronously Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 009/121] ionic: check for NULL structs on teardown Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 010/121] net: phy: mscc: accept all RGMII species in vsc85xx_mac_if_set Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 018/121] selftests/bpf: Fix test_progs's parsing of test numbers Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 019/121] net/mlx5: E-Switch, Hold mutex when querying drop counter in legacy mode Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 020/121] libbpf: Ignore incompatible types with matching name during CO-RE relocation Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 023/121] ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 024/121] mwifiex: set needed_headroom, not hard_header_len Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 025/121] Bluetooth: L2CAP: handle l2cap config request during open state Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 027/121] ath10k: fix not registering airtime of 11a station with WMM disable Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 029/121] net/mlx5e: Init ethtool steering for representors Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 031/121] Bluetooth: Fix calculation of SCO handle for packet processing Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 032/121] net: rmnet: add missing module alias Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 035/121] Bluetooth: guard against controllers sending zero'd events Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 040/121] net: hns3: modify an unsuitable print when setting unknown duplex to fibre Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 042/121] net: intel: e1000e: fix possible sleep-in-atomic-context bugs in e1000e_get_hw_semaphore() Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 043/121] net: dsa: bcm_sf2: Also configure Port 5 for 2Gb/sec on 7278 Sasha Levin
2020-04-12 1:16 ` Florian Fainelli
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 044/121] sh_eth: check sh_eth_cpu_data::no_tx_cntrs when dumping registers Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 045/121] sh_eth: check sh_eth_cpu_data::cexcr " Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 046/121] sh_eth: check sh_eth_cpu_data::no_xdfar " Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 047/121] ice: Fix implicit queue mapping mode in ice_vsi_get_qs Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 049/121] mt76: mt7615: disable 5 GHz on MT7622 Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 050/121] mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw Sasha Levin
2020-04-11 23:05 ` [PATCH AUTOSEL 5.5 051/121] rtw88: Fix incorrect beamformee role setting Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 055/121] rtw88: 8822c: update power sequence to v16 Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 065/121] rsi: fix null pointer dereference during rsi_shutdown() Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 068/121] mt76: mt7603: fix input validation issues for powersave-filtered frames Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 076/121] Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 078/121] ath10k: start recovery process when read int status fail for sdio Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 088/121] net: axienet: Propagate failure of DMA descriptor setup Sasha Levin
2020-04-11 23:06 ` Sasha Levin [this message]
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 090/121] brcmfmac: Fix double freeing in the fmac usb data path Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 091/121] brcmfmac: fix the incorrect return value in brcmf_inform_single_bss() Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 092/121] xfrm: add prep for esp beet mode offload Sasha Levin
2020-04-11 23:06 ` [PATCH AUTOSEL 5.5 095/121] netfilter: nf_tables: silence a RCU-list warning in nft_table_lookup() Sasha Levin
2020-04-11 23:07 ` [PATCH AUTOSEL 5.5 119/121] svcrdma: Fix leak of transport addresses Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200411230706.23855-89-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=brcm80211-dev-list.pdl@broadcom.com \
--cc=brcm80211-dev-list@cypress.com \
--cc=chi-hsien.lin@cypress.com \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=raveendran.somu@cypress.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).