From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
To: "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Cc: Ping-Ke Shih <pkshih@realtek.com>
Subject: Re: [PATCH rtw-next v3 12/14] wifi: rtw89: Add usb.{c,h}
Date: Mon, 23 Jun 2025 23:08:39 +0300 [thread overview]
Message-ID: <1e5e97d4-8267-4f77-a4bf-1fe23ea40f77@gmail.com> (raw)
In-Reply-To: <4f456355-fdc5-4624-ab00-ed374f3b58a1@gmail.com>
On 20/06/2025 22:04, Bitterblue Smith wrote:
> Add very basic USB support. No TX/RX aggregation, no TX queues,
Commit 47a498b84f01 ("wifi: rtw89: TX nulldata 0 after scan complete")
exposed a problem with my lazy "no TX queues" approach:
[30316.444515] BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait+0xed/0x1e0 [rtw89_core]
[30316.444616] Use-after-free write at 0x00000000719224cd (in kfence-#231):
[30316.444623] rtw89_core_tx_kick_off_and_wait+0xed/0x1e0 [rtw89_core]
[30316.444716] rtw89_core_scan_complete+0x19b/0x260 [rtw89_core]
[30316.444810] rtw89_hw_scan_complete_cb+0xbb/0x150 [rtw89_core]
[30316.444906] rtw89_chanctx_proceed_cb+0x21/0x40 [rtw89_core]
[30316.444988] rtw89_chanctx_proceed+0x45/0x90 [rtw89_core]
[30316.445067] rtw89_hw_scan_complete+0x4e/0x70 [rtw89_core]
[30316.445156] rtw89_mac_c2h_scanofld_rsp+0x33a/0x380 [rtw89_core]
[30316.445241] rtw89_fw_c2h_cmd_handle+0x89/0x100 [rtw89_core]
[30316.445332] rtw89_fw_c2h_work+0x3c/0x60 [rtw89_core]
[30316.445412] cfg80211_wiphy_work+0x110/0x190 [cfg80211]
[30316.445412] process_one_work+0x190/0x350
[30316.445412] worker_thread+0x2d7/0x410
[30316.445412] kthread+0xf9/0x240
[30316.445412] ret_from_fork+0x31/0x50
[30316.445412] ret_from_fork_asm+0x1a/0x30
[30316.445412] kfence-#231: 0x0000000049346f7c-0x000000006dacad1c, size=232, cache=skbuff_head_cache
[30316.445412] allocated by task 17836 on cpu 0 at 30316.413509s (0.031903s ago):
[30316.445412] __alloc_skb+0x148/0x1a0
[30316.445412] __netdev_alloc_skb+0x38/0x190
[30316.445412] ieee80211_nullfunc_get+0x3f/0x210 [mac80211]
[30316.445412] rtw89_core_send_nullfunc+0xd2/0x190 [rtw89_core]
[30316.445412] rtw89_core_scan_complete+0x19b/0x260 [rtw89_core]
[30316.445412] rtw89_hw_scan_complete_cb+0xbb/0x150 [rtw89_core]
[30316.445412] rtw89_chanctx_proceed_cb+0x21/0x40 [rtw89_core]
[30316.445412] rtw89_chanctx_proceed+0x45/0x90 [rtw89_core]
[30316.445412] rtw89_hw_scan_complete+0x4e/0x70 [rtw89_core]
[30316.445412] rtw89_mac_c2h_scanofld_rsp+0x33a/0x380 [rtw89_core]
[30316.445412] rtw89_fw_c2h_cmd_handle+0x89/0x100 [rtw89_core]
[30316.445412] rtw89_fw_c2h_work+0x3c/0x60 [rtw89_core]
[30316.445412] cfg80211_wiphy_work+0x110/0x190 [cfg80211]
[30316.445412] process_one_work+0x190/0x350
[30316.445412] worker_thread+0x2d7/0x410
[30316.445412] kthread+0xf9/0x240
[30316.445412] ret_from_fork+0x31/0x50
[30316.445412] ret_from_fork_asm+0x1a/0x30
[30316.445412] freed by task 0 on cpu 3 at 30316.413558s (0.031854s ago):
[30316.445412] ieee80211_tx_status_skb+0x75/0xb0 [mac80211]
[30316.445412] ieee80211_handle_queued_frames+0x9f/0xd0 [mac80211]
[30316.445412] tasklet_action_common+0xc5/0x230
[30316.445412] handle_softirqs+0xe3/0x2a0
[30316.445412] __irq_exit_rcu+0xcb/0xf0
[30316.445412] common_interrupt+0x85/0xa0
[30316.445412] asm_common_interrupt+0x26/0x40
[30316.445412] cpuidle_enter_state+0xbb/0x410
[30316.445412] cpuidle_enter+0x31/0x50
[30316.445412] do_idle+0x1b1/0x210
[30316.445412] cpu_startup_entry+0x29/0x30
[30316.445412] start_secondary+0x119/0x140
[30316.445412] common_startup_64+0x13e/0x141
[30316.445412] CPU: 0 UID: 0 PID: 17836 Comm: kworker/u16:1 Tainted: G OE 6.15.1-arch1-2 #1 PREEMPT(full) cd63386364b969355862abafc710704c8116e874
[30316.445412] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[30316.445412] Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
[30316.445412] Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
rtw89_core_send_nullfunc() calls rtw89_core_tx_write_link().
rtw89_usb_ops_tx_write() transmits the frame immediately and
rtw89_usb_write_port_complete() hands it to
ieee80211_tx_status_irqsafe(). Then rtw89_core_send_nullfunc()
calls rtw89_core_tx_kick_off_and_wait(), but the nullfunc was
already freed by mac80211.
So I will add TX queues in v4.
next prev parent reply other threads:[~2025-06-23 20:08 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-20 18:51 [PATCH rtw-next v3 00/14] wifi: rtw89: Add support for USB devices Bitterblue Smith
2025-06-20 18:53 ` [PATCH rtw-next v3 01/14] wifi: rtw89: 8851b: Accept USB devices and load their MAC address Bitterblue Smith
2025-06-20 18:54 ` [PATCH rtw-next v3 02/14] wifi: rtw89: Make dle_mem in rtw89_chip_info an array Bitterblue Smith
2025-06-24 5:42 ` Ping-Ke Shih
2025-06-20 18:56 ` [PATCH rtw-next v3 03/14] wifi: rtw89: Make hfc_param_ini " Bitterblue Smith
2025-06-24 5:45 ` Ping-Ke Shih
2025-06-20 18:56 ` [PATCH rtw-next v3 04/14] wifi: rtw89: Add rtw8851b_dle_mem_usb{2,3} Bitterblue Smith
2025-06-20 18:57 ` [PATCH rtw-next v3 05/14] wifi: rtw89: Add rtw8851b_hfc_param_ini_usb Bitterblue Smith
2025-06-20 18:58 ` [PATCH rtw-next v3 06/14] wifi: rtw89: Disable deep power saving for USB/SDIO Bitterblue Smith
2025-06-24 5:50 ` Ping-Ke Shih
2025-06-20 18:59 ` [PATCH rtw-next v3 07/14] wifi: rtw89: Add extra TX headroom for USB Bitterblue Smith
2025-06-20 19:00 ` [PATCH rtw-next v3 08/14] wifi: rtw89: Hide some errors when the device is unplugged Bitterblue Smith
2025-06-20 19:01 ` [PATCH rtw-next v3 09/14] wifi: rtw89: 8851b: Modify rtw8851b_pwr_{on,off}_func() for USB Bitterblue Smith
2025-06-24 5:51 ` Ping-Ke Shih
2025-06-20 19:02 ` [PATCH rtw-next v3 10/14] wifi: rtw89: Fix rtw89_mac_power_switch() " Bitterblue Smith
2025-06-24 5:52 ` Ping-Ke Shih
2025-06-20 19:03 ` [PATCH rtw-next v3 11/14] wifi: rtw89: Add some definitions " Bitterblue Smith
2025-06-20 19:04 ` [PATCH rtw-next v3 12/14] wifi: rtw89: Add usb.{c,h} Bitterblue Smith
2025-06-23 20:08 ` Bitterblue Smith [this message]
2025-06-24 6:18 ` Ping-Ke Shih
2025-06-20 19:05 ` [PATCH rtw-next v3 13/14] wifi: rtw89: Add rtw8851bu.c Bitterblue Smith
2025-06-20 19:05 ` [PATCH rtw-next v3 14/14] wifi: rtw89: Enable the new USB modules Bitterblue Smith
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1e5e97d4-8267-4f77-a4bf-1fe23ea40f77@gmail.com \
--to=rtl8821cerfe2@gmail.com \
--cc=linux-wireless@vger.kernel.org \
--cc=pkshih@realtek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.