From patchwork Fri Nov 24 12:52:25 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arend van Spriel X-Patchwork-Id: 10074015 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id DDAD66037F for ; Fri, 24 Nov 2017 12:52:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CEAF92A30F for ; Fri, 24 Nov 2017 12:52:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C34582A34D; Fri, 24 Nov 2017 12:52:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 60F8C2A30F for ; Fri, 24 Nov 2017 12:52:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753584AbdKXMwc (ORCPT ); Fri, 24 Nov 2017 07:52:32 -0500 Received: from mail-wm0-f41.google.com ([74.125.82.41]:40694 "EHLO mail-wm0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753576AbdKXMw2 (ORCPT ); Fri, 24 Nov 2017 07:52:28 -0500 Received: by mail-wm0-f41.google.com with SMTP id b189so22353977wmd.5 for ; Fri, 24 Nov 2017 04:52:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=sJLSib4ch2BJs3aa3u+ztARsLImMcs3h2RRVrI5lrKE=; b=IViZLfxnWh31l66PqbfQCd5R5WtDz5hGT5+gzDG5pMRjT9YlFgtWr76sv916h+vfxy rGtMsrSGlSsfIIKTBU7uLDyE35/myDTpqpFpvjSptyRqtaKWwdOxrC4lTDFLSyo0pRIL yKr/woUs1G5znnGzTyc31OEZ566yHjdNj5CZs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=sJLSib4ch2BJs3aa3u+ztARsLImMcs3h2RRVrI5lrKE=; b=fPUzVEvHtmMWR9jcaNooYd+Bu2CwTWqmVNabRboReS2O4K9W08CMfTfdpaKmeBqaJN W2pujN2LqScEfe91pDMWx5YHTDL4CJQqNK1D4/DbTcCQmKyP2R69Fsu4nsLi5ff/PjiN AlQygAZeFtRqyOa5v/zdv3sbrp6n+cz+StYXciOA5FGEJe6L1AO4nZMefexHsIZcVL9s y2nuXznGJX6bLGvrLIrxpvwVqP2hjm80QdFRc6dH7tcWJP0P6rtw3OayByz1Ek2/qYPt 8nFXweGieB4y049E4gBJqkGfW+M2BqmuLLfZXVa/3QU0HfKn5jtQLc2BomI8NuQw/gno Qsbw== X-Gm-Message-State: AJaThX7ek6dCgF3kYnKx9pdfkHXm6Pewj+lUg+TDa0+w8LcH2xm/s7W6 Ha3oeoA6+TS8pb3oym89vVGQ4w== X-Google-Smtp-Source: AGs4zMYW3qR5BM9pQtq35HTJmqhaRmZG5KDO+6LtzCn/MWOItah2t56u0UXzrwejNCwwbUWEM2i+/w== X-Received: by 10.28.194.139 with SMTP id s133mr9271236wmf.14.1511527946808; Fri, 24 Nov 2017 04:52:26 -0800 (PST) Received: from [10.176.68.125] ([192.19.248.250]) by smtp.gmail.com with ESMTPSA id x185sm6131473wmx.12.2017.11.24.04.52.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 24 Nov 2017 04:52:26 -0800 (PST) Subject: Re: brcmfmac: Unable to handle kernel paging request at virtual address 726f6674616cd8 To: Stefan Wahren , Franky Lin , Chi-Hsien Lin , Wright Feng , Hante Meuleman References: <578431614.96494.1510505412682@email.1und1.de> <1906631797.229909.1511367617667@email.1und1.de> <08b0ba6f-d4e7-576e-18fe-98e8247d2d91@broadcom.com> <1736744183.124.1511378235966@email.1und1.de> Cc: brcm80211-dev-list.pdl@broadcom.com, linux-wireless@vger.kernel.org, Kalle Valo , brcm80211-dev-list@cypress.com From: Arend van Spriel Message-ID: <5A181609.40907@broadcom.com> Date: Fri, 24 Nov 2017 13:52:25 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 MIME-Version: 1.0 In-Reply-To: <1736744183.124.1511378235966@email.1und1.de> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On 11/22/2017 8:17 PM, Stefan Wahren wrote: > Hi Arend, > >> Arend van Spriel hat am 22. November 2017 um 19:23 geschrieben: >> >> >> On 22-11-17 17:20, Stefan Wahren wrote: >>> Hi, >>> >>>> Stefan Wahren hat am 12. November 2017 um 17:50 geschrieben: >>>> >>>> >>>> Hi, >>>> i discovered a random oops during probe of brcmfmac on Raspberry Pi 3 in yesterdays kernelci run for net-next [1]. I need to point out there is no DT entry for the wifi chip on Raspberry Pi 3 in the lack of a driver for the necessary GPIO expander. So the "HT Avail timeout" is expected. >>>> >>>> I was also able to trigger this oops by calling "modprobe brcmfmac" on my Raspberry Pi 3 with latest linux-next. >>>> >>>> Any help to fix this is appreciated. >>>> >>>> [1] - https://storage.kernelci.org/net-next/master/v4.14-rc8-2221-ga8a6f1e4ea78/arm64/defconfig+kselftest/lab-baylibre/boot-bcm2837-rpi-3-b.txt >>>> >>> >>> the issue still persists in linux-next-20171122: >>> >> ... >> >> seems like a use-after-free. We do a device_release_driver() twice. Once >> for sdio func #1 and for sdio func #2. This was introduced by: >> >> commit 7a51461fc2da82a6c565a3ee65c41c197f28225d >> Author: Arend Van Spriel >> Date: Mon Jun 12 12:47:34 2017 +0100 >> >> brcmfmac: unbind all devices upon failure in firmware callback >> >> What we do is: >> >> device_release_driver(dev); >> device_release_driver(&sdiodev->func[2]->dev); >> >> with the assumption that dev == &sdiodev->func[1]->dev. I wonder if that >> is always true. The error print did not make it in your log. Maybe we >> should make it explicit here (see below). > > i tried it, but the issue still occurs. > > Maybe this is helpful but this issue doesn't happend everytime. Sometimes i need 2 attemps via unloading/loading. > I just realized the remove of sdio func #1 removes everything so we must first remove sdio func #2. Can you try the patch below. Regards, Arend --- struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/n index b2256aa..58fa438 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c @@ -4121,8 +4121,8 @@ static void brcmf_sdio_firmware_callback(struct device *de sdio_release_host(sdiodev->func[1]); fail: brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err); - device_release_driver(dev); device_release_driver(&sdiodev->func[2]->dev); + device_release_driver(dev); }