From patchwork Wed May 11 22:06:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Daudt X-Patchwork-Id: 9075231 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id DD0799F372 for ; Wed, 11 May 2016 22:07:36 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id EC05720155 for ; Wed, 11 May 2016 22:07:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E2BB32010F for ; Wed, 11 May 2016 22:07:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752095AbcEKWHd (ORCPT ); Wed, 11 May 2016 18:07:33 -0400 Received: from mail-pa0-f43.google.com ([209.85.220.43]:33901 "EHLO mail-pa0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751617AbcEKWHc (ORCPT ); Wed, 11 May 2016 18:07:32 -0400 Received: by mail-pa0-f43.google.com with SMTP id r5so22686569pag.1 for ; Wed, 11 May 2016 15:07:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=BoT1vpBjhHWU63qpJuVNq1LM6XpadvpGimqcL031H7s=; b=Zyii/JkYHz9XfpYC76Tr+RBF70eEmm7f8ekPcxAT1eB6m68gxh7gzdvIIurY0h1tZn JzfUelPbd7ljlsImMlyv53l3gr5ohymHyykZ+UvMx7kOdu1zGJaz0FG4Jf/PZiXMGUC+ sv9Cg9gT9kOio6vfy7nTctzNoLkDDOhH2VGKM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=BoT1vpBjhHWU63qpJuVNq1LM6XpadvpGimqcL031H7s=; b=iasPUBAb491I4qb39hBV0Lk81BWzsGI2hKkH7+ex2FPjhpDNYc5gXZ8dZZ2pAxpn5t 0yx0UQk2kTskpJVCzWAvU0RPm5w7lSkzpPuX1a08bDrKlc6mj7nrYD2OWFeDnsTX5p3A jQunRnFH/MX9X1yC22NJ8DVz6p42YtChzP0px+LiEf9riZvycQVEfeULtTprIdKY9f4y Lgk8/bulHUwd9VUi7JWGW3wOVrh2RhE/dpXJTIPgNlsUpSFwVAG4J/L3auydcQctvj0m kEQ7E2YQT6DwNu4m8RXB4XQSQ9dcdSELS6bFpHMcNd3CWgfQqauNLsJMSnpctV2OdDR0 ++vw== X-Gm-Message-State: AOPr4FUXJkgnr0Qkz87FqTIByAaD8XdiVVorlg774BaIHstIq8OfKN57tIuR3aT+xlPzR6QN X-Received: by 10.66.132.103 with SMTP id ot7mr8537417pab.27.1463004451809; Wed, 11 May 2016 15:07:31 -0700 (PDT) Received: from rodan.ric.broadcom.com ([216.31.219.19]) by smtp.gmail.com with ESMTPSA id wy7sm14591678pab.5.2016.05.11.15.07.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 11 May 2016 15:07:30 -0700 (PDT) From: Christian Daudt To: linux-wireless@vger.kernel.org Cc: Christian Daudt , brcm80211-dev-list@broadcom.com, Brett Rudley , Arend van Spriel , Franky Lin , Hante Meuleman Subject: [PATCH v2 1/2] brcmfmac: Fix kernel oops in failed chip_attach Date: Wed, 11 May 2016 15:06:48 -0700 Message-Id: <1463004409-28885-2-git-send-email-csd@broadcom.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1463004409-28885-1-git-send-email-csd@broadcom.com> References: <1463004409-28885-1-git-send-email-csd@broadcom.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-8.2 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When chip attach fails, brcmf_sdiod_intr_unregister is being called but that is too early as sdiodev->settings has not been set yet nor has brcmf_sdiod_intr_register been called. Change to use oob_irq_requested + newly created sd_irq_requested to decide on what to unregister at intr_unregister time. Steps to reproduce problem: - modprobe brcmfmac using buggy FW - rmmod brcmfmac - modprobe brcmfmac again. If done with a buggy firmware, brcm_chip_attach will fail on the 2nd modprobe triggering the call to intr_unregister and the kernel oops when attempting to de-reference sdiodev->settings->bus.sdio which has not yet been set. Signed-off-by: Christian Daudt --- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 30 ++++++++++++---------- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + 2 files changed, 18 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index da0cdd3..09635a9 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -166,6 +166,7 @@ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev) sdio_claim_irq(sdiodev->func[1], brcmf_sdiod_ib_irqhandler); sdio_claim_irq(sdiodev->func[2], brcmf_sdiod_dummy_irqhandler); sdio_release_host(sdiodev->func[1]); + sdiodev->sd_irq_requested = true; } return 0; @@ -173,27 +174,30 @@ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev) int brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev) { - struct brcmfmac_sdio_pd *pdata; - brcmf_dbg(SDIO, "Entering\n"); + brcmf_dbg(SDIO, "Entering oob=%d sd=%d\n", + sdiodev->oob_irq_requested, + sdiodev->sd_irq_requested); - pdata = &sdiodev->settings->bus.sdio; - if (pdata->oob_irq_supported) { + if (sdiodev->oob_irq_requested) { + struct brcmfmac_sdio_pd *pdata; + + pdata = &sdiodev->settings->bus.sdio; sdio_claim_host(sdiodev->func[1]); brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL); brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL); sdio_release_host(sdiodev->func[1]); - if (sdiodev->oob_irq_requested) { - sdiodev->oob_irq_requested = false; - if (sdiodev->irq_wake) { - disable_irq_wake(pdata->oob_irq_nr); - sdiodev->irq_wake = false; - } - free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev); - sdiodev->irq_en = false; + sdiodev->oob_irq_requested = false; + if (sdiodev->irq_wake) { + disable_irq_wake(pdata->oob_irq_nr); + sdiodev->irq_wake = false; } - } else { + free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev); + sdiodev->irq_en = false; + } + + if (sdiodev->sd_irq_requested) { sdio_claim_host(sdiodev->func[1]); sdio_release_irq(sdiodev->func[2]); sdio_release_irq(sdiodev->func[1]); diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h index dcf0ce8c..c07ad25 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h @@ -186,6 +186,7 @@ struct brcmf_sdio_dev { struct brcmf_bus *bus_if; struct brcmf_mp_device *settings; bool oob_irq_requested; + bool sd_irq_requested; bool irq_en; /* irq enable flags */ spinlock_t irq_en_lock; bool irq_wake; /* irq wake enable flags */