From patchwork Sun Nov 9 18:10:13 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathy Vanhoef X-Patchwork-Id: 5261701 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 94149C11AC for ; Sun, 9 Nov 2014 18:10:46 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id AC44120127 for ; Sun, 9 Nov 2014 18:10:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B7720200CF for ; Sun, 9 Nov 2014 18:10:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751424AbaKISKU (ORCPT ); Sun, 9 Nov 2014 13:10:20 -0500 Received: from mail-wg0-f45.google.com ([74.125.82.45]:35208 "EHLO mail-wg0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751040AbaKISKS (ORCPT ); Sun, 9 Nov 2014 13:10:18 -0500 Received: by mail-wg0-f45.google.com with SMTP id x12so7221219wgg.32 for ; Sun, 09 Nov 2014 10:10:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; bh=mXg5C+/6OIpphoaGolBFKpGpMvE3GCmJHi7sRP1CuOk=; b=sJpblY6VwqL9ZFnvzWj/FQUzKcYrhk/RCVfBDo7BcnN3VdL8v67zwsL5KwZyYDV2Ko UgKJGXAE3dfyWPowqMF2q2+5WZlgdVO91GsuQBMY8Za9ViVqj1/dGC4MeRKzXS8S8uBy ngxAjLJ7u3swm+e5BYfSJ+O8MBAYwptP18G9bjhallA1P2AZHBcxxd24mYBBFaKJb/nI kJrI1nk0gtGigrKRxFRTPGQn2GKILM0UbTk2PLSTPJBa4I+s7DGw6/0idpu1HBAxYpEC /WmKkBvXKUhEPzQ+bSZ17EYnbyBML5DkGSK3RMs0J9rURPH3s5117G00XCJKzG+eBTOq BVgg== X-Received: by 10.180.9.33 with SMTP id w1mr24098975wia.22.1415556616894; Sun, 09 Nov 2014 10:10:16 -0800 (PST) Received: from [192.168.80.131] (ip-83-134-30-104.dsl.scarlet.be. [83.134.30.104]) by mx.google.com with ESMTPSA id cz3sm20037036wjb.23.2014.11.09.10.10.15 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 09 Nov 2014 10:10:16 -0800 (PST) Message-ID: <545FAE05.2030701@gmail.com> Date: Sun, 09 Nov 2014 13:10:13 -0500 From: Mathy Vanhoef User-Agent: Mozilla/5.0 (X11; Linux i686; rv:31.0) Gecko/20100101 Icedove/31.2.0 MIME-Version: 1.0 To: brudley@broadcom.com, arend@broadcom.com, frankyl@broadcom.com, meuleman@broadcom.com, linville@tuxdriver.com, pieterpg@broadcom.com, linux-wireless@vger.kernel.org, brcm80211-dev-list@broadcom.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] brcmfmac: unlink URB when request timed out Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Mathy Vanhoef Unlink the submitted URB in brcmf_usb_dl_cmd if the request timed out. This assures the URB is never submitted twice, preventing a driver crash. Signed-off-by: Mathy Vanhoef --- Currently brcmfmac may crash when a USB device is attached (tested with a LG TWFM-B003D). In particular it fails on the second call to brcmf_usb_dl_cmd in the while loop of brcmf_usb_resetcfg. The problem is that an URB is being submitted twice: [ 169.861800] brcmfmac: brcmf_usb_dl_writeimage Enter, fw f14db000, len 348160 [ 171.787791] brcmfmac: brcmf_usb_dl_writeimage Exit, err=0 [ 171.787797] brcmfmac: brcmf_usb_dlstart Exit, err=0 [ 171.787799] brcmfmac: brcmf_usb_dlrun Enter [ 171.791794] brcmfmac: brcmf_usb_resetcfg Enter [ 173.988072] ------------[ cut here ]------------ [ 173.988083] WARNING: CPU: 0 PID: 369 at drivers/usb/core/urb.c:339 usb_submit_urb+0x4e6/0x500() [ 173.988085] URB eaf45f00 submitted while active [ 173.988086] Modules linked in: brcmfmac brcmutil vmw_pvscsi pcnet32 mptspi mptscsih mptbase [ 173.988100] CPU: 0 PID: 369 Comm: kworker/0:2 Not tainted 3.18.0-rc3-wl #1 [ 173.988102] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 173.988106] Workqueue: events request_firmware_work_func [ 173.988108] 00000000 00000000 ee747db8 c1711f4a ee747df8 ee747de8 c103edaf c18d1e10 [ 173.988112] ee747e14 00000171 c18a8b29 00000153 c1490556 c1490556 eaf45f00 eafdc660 [ 173.988115] f14b8fa0 ee747e00 c103ee4e 00000009 ee747df8 c18d1e10 ee747e14 ee747e50 [ 173.988119] Call Trace: [ 173.988129] [] dump_stack+0x41/0x52 [ 173.988136] [] warn_slowpath_common+0x7f/0xa0 [ 173.988139] [] ? usb_submit_urb+0x4e6/0x500 [ 173.988141] [] ? usb_submit_urb+0x4e6/0x500 [ 173.988147] [] ? brcmf_usb_ioctl_resp_wake+0x40/0x40 [brcmfmac] [ 173.988150] [] warn_slowpath_fmt+0x2e/0x30 [ 173.988152] [] usb_submit_urb+0x4e6/0x500 [ 173.988156] [] ? __kmalloc+0x21/0x140 [ 173.988161] [] ? brcmf_usb_dl_cmd+0x33/0x120 [brcmfmac] [ 173.988166] [] brcmf_usb_dl_cmd+0xb3/0x120 [brcmfmac] [ 173.988170] [] brcmf_usb_probe_phase2+0x4e4/0x640 [brcmfmac] [ 173.988176] [] brcmf_fw_request_code_done+0xd0/0xf0 [brcmfmac] [ 173.988178] [] request_firmware_work_func+0x26/0x50 [ 173.988182] [] process_one_work+0x11e/0x360 [ 173.988184] [] worker_thread+0xf0/0x3c0 [ 173.988205] [] ? __wake_up_locked+0x1a/0x20 [ 173.988208] [] ? process_scheduled_works+0x30/0x30 [ 173.988211] [] kthread+0x96/0xb0 [ 173.988214] [] ret_from_kernel_thread+0x21/0x30 [ 173.988217] [] ? kthread_worker_fn+0x110/0x110 [ 173.988219] ---[ end trace 0c88bf46801de083 ]--- [ 173.988221] brcmf_usb_dl_cmd: usb_submit_urb failed -16 [ 173.988396] brcmfmac: brcmf_usb_probe_phase2 failed: dev=1-1, err=-19 [ 173.989503] brcmfmac: brcmf_usb_disconnect Enter This patch fixes the brcmf_usb_dl_cmd function to prevent an URB from being submitted twice. Tested using a LG TWFM-B003D, which now works properly. drivers/net/wireless/brcm80211/brcmfmac/usb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c index 5265aa7..1bc7858 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c @@ -738,10 +738,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd, goto finalize; } - if (!brcmf_usb_ioctl_resp_wait(devinfo)) + if (!brcmf_usb_ioctl_resp_wait(devinfo)) { + usb_unlink_urb(devinfo->ctl_urb); ret = -ETIMEDOUT; - else + } else { memcpy(buffer, tmpbuf, buflen); + } finalize: kfree(tmpbuf);