From patchwork Wed May 4 19:30:28 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Daudt X-Patchwork-Id: 9018031 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 8EE259F1C1 for ; Wed, 4 May 2016 19:31:07 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A1A19203C1 for ; Wed, 4 May 2016 19:31:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id F27DF203C0 for ; Wed, 4 May 2016 19:31:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753005AbcEDTa4 (ORCPT ); Wed, 4 May 2016 15:30:56 -0400 Received: from mail-pf0-f176.google.com ([209.85.192.176]:35191 "EHLO mail-pf0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752664AbcEDTaz (ORCPT ); Wed, 4 May 2016 15:30:55 -0400 Received: by mail-pf0-f176.google.com with SMTP id 77so28458302pfv.2 for ; Wed, 04 May 2016 12:30:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id; bh=BoT1vpBjhHWU63qpJuVNq1LM6XpadvpGimqcL031H7s=; b=V9HKav2Emv4mv+mebZLAiHyzoMmSLEM7G/Yb8RV6BcwNtPdp8w3WmoTTddKyAZjCTY gCLbmymgOOPD3Zt8u2899RH/Pyc7uwJiMAPrg7mteufjH3LemWyM69B7hbYpglnqCzgp iE1N9Wqds6McfZjlE3k1+xJTquRPHyjitG6Wk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=BoT1vpBjhHWU63qpJuVNq1LM6XpadvpGimqcL031H7s=; b=Un4H5ygOsq7WqP0ZomOaVwP3JWQLOJggYuep2g5odms0t8DqXMOk4Y8ahTo2BH1ej5 DYKuLzle8kdjL7gvltaOAf/+5tqa7C73lwaA5lvURRbjsimeblOQhnivZq/ipKctu4WB xBzMsXfhQiIFuAXD4KxieiC7uCj1/srYPzJtab8xXpHrm0oPl3VHt5uoLi5jCQTQHil8 qNJChIisNDL1IBFMamVUGudcvtiCMZTEFrhouygtj5dsx0XgDbdmfDnzGS4++LzNycTK EQb6CfRWA96DYUlbKVbxHx3UDYRuzH545SqXux60jBzRxT23XpPXqh4trprykoFum62y /5Qg== X-Gm-Message-State: AOPr4FX1ERbIwv6LUO+XQDB37URzlWYNBNOvqrrVJXVKKFRYnqL3gIoL75U0A7wJN5P5Z43P X-Received: by 10.98.98.6 with SMTP id w6mr2994524pfb.0.1462390254253; Wed, 04 May 2016 12:30:54 -0700 (PDT) Received: from rodan.ric.broadcom.com ([216.31.219.19]) by smtp.gmail.com with ESMTPSA id h16sm6342598pfj.0.2016.05.04.12.30.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 04 May 2016 12:30:52 -0700 (PDT) From: Christian Daudt To: linux-wireless@vger.kernel.org Cc: Christian Daudt , brcm80211-dev-list@broadcom.com, Brett Rudley , Arend van Spriel , Franky Lin , Hante Meuleman Subject: [PATCH] Fix kernel oops in failed chip_attach Date: Wed, 4 May 2016 12:30:28 -0700 Message-Id: <1462390228-27863-1-git-send-email-csd@broadcom.com> X-Mailer: git-send-email 1.9.1 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-8.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When chip attach fails, brcmf_sdiod_intr_unregister is being called but that is too early as sdiodev->settings has not been set yet nor has brcmf_sdiod_intr_register been called. Change to use oob_irq_requested + newly created sd_irq_requested to decide on what to unregister at intr_unregister time. Steps to reproduce problem: - modprobe brcmfmac using buggy FW - rmmod brcmfmac - modprobe brcmfmac again. If done with a buggy firmware, brcm_chip_attach will fail on the 2nd modprobe triggering the call to intr_unregister and the kernel oops when attempting to de-reference sdiodev->settings->bus.sdio which has not yet been set. Signed-off-by: Christian Daudt --- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 30 ++++++++++++---------- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + 2 files changed, 18 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index da0cdd3..09635a9 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -166,6 +166,7 @@ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev) sdio_claim_irq(sdiodev->func[1], brcmf_sdiod_ib_irqhandler); sdio_claim_irq(sdiodev->func[2], brcmf_sdiod_dummy_irqhandler); sdio_release_host(sdiodev->func[1]); + sdiodev->sd_irq_requested = true; } return 0; @@ -173,27 +174,30 @@ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev) int brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev) { - struct brcmfmac_sdio_pd *pdata; - brcmf_dbg(SDIO, "Entering\n"); + brcmf_dbg(SDIO, "Entering oob=%d sd=%d\n", + sdiodev->oob_irq_requested, + sdiodev->sd_irq_requested); - pdata = &sdiodev->settings->bus.sdio; - if (pdata->oob_irq_supported) { + if (sdiodev->oob_irq_requested) { + struct brcmfmac_sdio_pd *pdata; + + pdata = &sdiodev->settings->bus.sdio; sdio_claim_host(sdiodev->func[1]); brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL); brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL); sdio_release_host(sdiodev->func[1]); - if (sdiodev->oob_irq_requested) { - sdiodev->oob_irq_requested = false; - if (sdiodev->irq_wake) { - disable_irq_wake(pdata->oob_irq_nr); - sdiodev->irq_wake = false; - } - free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev); - sdiodev->irq_en = false; + sdiodev->oob_irq_requested = false; + if (sdiodev->irq_wake) { + disable_irq_wake(pdata->oob_irq_nr); + sdiodev->irq_wake = false; } - } else { + free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev); + sdiodev->irq_en = false; + } + + if (sdiodev->sd_irq_requested) { sdio_claim_host(sdiodev->func[1]); sdio_release_irq(sdiodev->func[2]); sdio_release_irq(sdiodev->func[1]); diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h index dcf0ce8c..c07ad25 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h @@ -186,6 +186,7 @@ struct brcmf_sdio_dev { struct brcmf_bus *bus_if; struct brcmf_mp_device *settings; bool oob_irq_requested; + bool sd_irq_requested; bool irq_en; /* irq enable flags */ spinlock_t irq_en_lock; bool irq_wake; /* irq wake enable flags */