diff mbox series

[V3,1/6] brcmfmac: Fix driver crash on USB control transfer timeout

Message ID 1585124429-97371-2-git-send-email-chi-hsien.lin@cypress.com (mailing list archive)
State Accepted
Commit 93a5bfbc7cad8bf3dea81c9bc07761c1226a0860
Delegated to: Kalle Valo
Headers show
Series brcmfmac: USB change series | expand

Commit Message

Chi-Hsien Lin March 25, 2020, 8:20 a.m. UTC 
From: Raveendran Somu <raveendran.somu@cypress.com>

When the control transfer gets timed out, the error status
was returned without killing that urb, this leads to using
the same urb. This issue causes the kernel crash as the same
urb is sumbitted multiple times. The fix is to kill the
urb for timeout transfer before returning error

Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Kalle Valo March 26, 2020, 9:44 a.m. UTC | #1 
Chi-Hsien Lin <chi-hsien.lin@cypress.com> wrote:

> From: Raveendran Somu <raveendran.somu@cypress.com>
> 
> When the control transfer gets timed out, the error status
> was returned without killing that urb, this leads to using
> the same urb. This issue causes the kernel crash as the same
> urb is sumbitted multiple times. The fix is to kill the
> urb for timeout transfer before returning error
> 
> Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>

5 patches applied to wireless-drivers-next.git, thanks.

93a5bfbc7cad brcmfmac: Fix driver crash on USB control transfer timeout
78179869dc3f brcmfmac: Fix double freeing in the fmac usb data path
bd9944918ceb brcmfmac: fix the incorrect return value in brcmf_inform_single_bss().
2bc50d8828ad brcmfmac: increase max hanger slots from 1K to 3K in fws layer
7f1d42304d93 brcmfmac: add USB autosuspend feature support
diff mbox series

Patch

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
index 575ed19e9195..10387a7f5d56 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -328,11 +328,12 @@  static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 		return err;
 	}
 	timeout = brcmf_usb_ioctl_resp_wait(devinfo);
-	clear_bit(0, &devinfo->ctl_op);
 	if (!timeout) {
 		brcmf_err("Txctl wait timed out\n");
+		usb_kill_urb(devinfo->ctl_urb);
 		err = -EIO;
 	}
+	clear_bit(0, &devinfo->ctl_op);
 	return err;
 }
 
@@ -358,11 +359,12 @@  static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 	}
 	timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 	err = devinfo->ctl_urb_status;
-	clear_bit(0, &devinfo->ctl_op);
 	if (!timeout) {
 		brcmf_err("rxctl wait timed out\n");
+		usb_kill_urb(devinfo->ctl_urb);
 		err = -EIO;
 	}
+	clear_bit(0, &devinfo->ctl_op);
 	if (!err)
 		return devinfo->ctl_urb_actual_length;
 	else