* [PATCH net] wifi: rtw88: properly drop usb interface reference on error @ 2026-02-23 11:37 Greg Kroah-Hartman 2026-02-24 0:46 ` Ping-Ke Shih 2026-03-03 3:07 ` Ping-Ke Shih 0 siblings, 2 replies; 7+ messages in thread From: Greg Kroah-Hartman @ 2026-02-23 11:37 UTC (permalink / raw) To: linux-wireless; +Cc: linux-kernel, Greg Kroah-Hartman, Ping-Ke Shih, stable If an error happens in the usb probe path, in rtw_usb_intf_init(), the usb interface reference needs to be properly dropped, otherwise is is incorrectly increased when returning to the USB core. Cc: Ping-Ke Shih <pkshih@realtek.com> Cc: stable <stable@kernel.org> Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/net/wireless/realtek/rtw88/usb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c index 433b06c8d8a6..36ac20039ce2 100644 --- a/drivers/net/wireless/realtek/rtw88/usb.c +++ b/drivers/net/wireless/realtek/rtw88/usb.c @@ -1046,13 +1046,17 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, rtwusb->udev = udev; ret = rtw_usb_parse(rtwdev, intf); - if (ret) + if (ret) { + usb_put_dev(udev); return ret; + } rtwusb->usb_data = kcalloc(RTW_USB_MAX_RXTX_COUNT, sizeof(u32), GFP_KERNEL); - if (!rtwusb->usb_data) + if (!rtwusb->usb_data) { + usb_put_dev(udev); return -ENOMEM; + } usb_set_intfdata(intf, rtwdev->hw); -- 2.53.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* RE: [PATCH net] wifi: rtw88: properly drop usb interface reference on error 2026-02-23 11:37 [PATCH net] wifi: rtw88: properly drop usb interface reference on error Greg Kroah-Hartman @ 2026-02-24 0:46 ` Ping-Ke Shih 2026-02-24 1:09 ` Greg Kroah-Hartman 2026-03-03 3:07 ` Ping-Ke Shih 1 sibling, 1 reply; 7+ messages in thread From: Ping-Ke Shih @ 2026-02-24 0:46 UTC (permalink / raw) To: Greg Kroah-Hartman, linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org, stable Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > If an error happens in the usb probe path, in rtw_usb_intf_init(), the > usb interface reference needs to be properly dropped, otherwise is is > incorrectly increased when returning to the USB core. > > Cc: Ping-Ke Shih <pkshih@realtek.com> > Cc: stable <stable@kernel.org> > Assisted-by: gkh_clanker_2000 > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > --- > drivers/net/wireless/realtek/rtw88/usb.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c > index 433b06c8d8a6..36ac20039ce2 100644 > --- a/drivers/net/wireless/realtek/rtw88/usb.c > +++ b/drivers/net/wireless/realtek/rtw88/usb.c > @@ -1046,13 +1046,17 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, > > rtwusb->udev = udev; > ret = rtw_usb_parse(rtwdev, intf); > - if (ret) > + if (ret) { > + usb_put_dev(udev); > return ret; > + } > > rtwusb->usb_data = kcalloc(RTW_USB_MAX_RXTX_COUNT, sizeof(u32), > GFP_KERNEL); > - if (!rtwusb->usb_data) > + if (!rtwusb->usb_data) { > + usb_put_dev(udev); > return -ENOMEM; > + } > > usb_set_intfdata(intf, rtwdev->hw); > Since rtwusb->udev isn't used right after assignment in this function. Would it be simpler that moving usb_get_dev() downward like below? diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c index db60e142268d..6e5c9c6f3e00 100644 --- a/drivers/net/wireless/realtek/rtw88/usb.c +++ b/drivers/net/wireless/realtek/rtw88/usb.c @@ -1041,10 +1041,8 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, struct usb_interface *intf) { struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); - struct usb_device *udev = usb_get_dev(interface_to_usbdev(intf)); int ret; - rtwusb->udev = udev; ret = rtw_usb_parse(rtwdev, intf); if (ret) return ret; @@ -1054,6 +1052,8 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, if (!rtwusb->usb_data) return -ENOMEM; + rtwusb->udev = usb_get_dev(interface_to_usbdev(intf)); + usb_set_intfdata(intf, rtwdev->hw); SET_IEEE80211_DEV(rtwdev->hw, &intf->dev); ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net] wifi: rtw88: properly drop usb interface reference on error 2026-02-24 0:46 ` Ping-Ke Shih @ 2026-02-24 1:09 ` Greg Kroah-Hartman 2026-02-24 1:49 ` Ping-Ke Shih 0 siblings, 1 reply; 7+ messages in thread From: Greg Kroah-Hartman @ 2026-02-24 1:09 UTC (permalink / raw) To: Ping-Ke Shih Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, stable On Tue, Feb 24, 2026 at 12:46:02AM +0000, Ping-Ke Shih wrote: > Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > > If an error happens in the usb probe path, in rtw_usb_intf_init(), the > > usb interface reference needs to be properly dropped, otherwise is is > > incorrectly increased when returning to the USB core. > > > > Cc: Ping-Ke Shih <pkshih@realtek.com> > > Cc: stable <stable@kernel.org> > > Assisted-by: gkh_clanker_2000 > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > --- > > drivers/net/wireless/realtek/rtw88/usb.c | 8 ++++++-- > > 1 file changed, 6 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c > > index 433b06c8d8a6..36ac20039ce2 100644 > > --- a/drivers/net/wireless/realtek/rtw88/usb.c > > +++ b/drivers/net/wireless/realtek/rtw88/usb.c > > @@ -1046,13 +1046,17 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, > > > > rtwusb->udev = udev; > > ret = rtw_usb_parse(rtwdev, intf); > > - if (ret) > > + if (ret) { > > + usb_put_dev(udev); > > return ret; > > + } > > > > rtwusb->usb_data = kcalloc(RTW_USB_MAX_RXTX_COUNT, sizeof(u32), > > GFP_KERNEL); > > - if (!rtwusb->usb_data) > > + if (!rtwusb->usb_data) { > > + usb_put_dev(udev); > > return -ENOMEM; > > + } > > > > usb_set_intfdata(intf, rtwdev->hw); > > > > Since rtwusb->udev isn't used right after assignment in this function. > Would it be simpler that moving usb_get_dev() downward like below? What is even simpler, and easier, is to never call usb_get_dev() at all anyway as it's not needed :) I created that pattern a few decades ago when we thought that it was going to be required, but as long as the usb interface is bound to the driver, that pointer is going to be valid so there's no real need to increment the reference count, except to feel good about doing it. I'll gladly do that fix instead, if you want me to, I was just trying to follow the style of the existing code and fix up the current bug. > diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c > index db60e142268d..6e5c9c6f3e00 100644 > --- a/drivers/net/wireless/realtek/rtw88/usb.c > +++ b/drivers/net/wireless/realtek/rtw88/usb.c > @@ -1041,10 +1041,8 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, > struct usb_interface *intf) > { > struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); > - struct usb_device *udev = usb_get_dev(interface_to_usbdev(intf)); > int ret; > > - rtwusb->udev = udev; > ret = rtw_usb_parse(rtwdev, intf); > if (ret) > return ret; > @@ -1054,6 +1052,8 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, > if (!rtwusb->usb_data) > return -ENOMEM; > > + rtwusb->udev = usb_get_dev(interface_to_usbdev(intf)); That too works, or again, just drop the usb_get_dev() and usb_put_dev() calls entirely. thanks, greg k-h ^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: [PATCH net] wifi: rtw88: properly drop usb interface reference on error 2026-02-24 1:09 ` Greg Kroah-Hartman @ 2026-02-24 1:49 ` Ping-Ke Shih 2026-02-24 6:18 ` Greg Kroah-Hartman 0 siblings, 1 reply; 7+ messages in thread From: Ping-Ke Shih @ 2026-02-24 1:49 UTC (permalink / raw) To: Greg Kroah-Hartman Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, stable Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > On Tue, Feb 24, 2026 at 12:46:02AM +0000, Ping-Ke Shih wrote: > > Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > > > If an error happens in the usb probe path, in rtw_usb_intf_init(), the > > > usb interface reference needs to be properly dropped, otherwise is is > > > incorrectly increased when returning to the USB core. > > > > > > Cc: Ping-Ke Shih <pkshih@realtek.com> > > > Cc: stable <stable@kernel.org> > > > Assisted-by: gkh_clanker_2000 > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > > --- > > > drivers/net/wireless/realtek/rtw88/usb.c | 8 ++++++-- > > > 1 file changed, 6 insertions(+), 2 deletions(-) > > > > > > diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c > > > index 433b06c8d8a6..36ac20039ce2 100644 > > > --- a/drivers/net/wireless/realtek/rtw88/usb.c > > > +++ b/drivers/net/wireless/realtek/rtw88/usb.c > > > @@ -1046,13 +1046,17 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, > > > > > > rtwusb->udev = udev; > > > ret = rtw_usb_parse(rtwdev, intf); > > > - if (ret) > > > + if (ret) { > > > + usb_put_dev(udev); > > > return ret; > > > + } > > > > > > rtwusb->usb_data = kcalloc(RTW_USB_MAX_RXTX_COUNT, sizeof(u32), > > > GFP_KERNEL); > > > - if (!rtwusb->usb_data) > > > + if (!rtwusb->usb_data) { > > > + usb_put_dev(udev); > > > return -ENOMEM; > > > + } > > > > > > usb_set_intfdata(intf, rtwdev->hw); > > > > > > > Since rtwusb->udev isn't used right after assignment in this function. > > Would it be simpler that moving usb_get_dev() downward like below? > > What is even simpler, and easier, is to never call usb_get_dev() at all > anyway as it's not needed :) > > I created that pattern a few decades ago when we thought that it was > going to be required, but as long as the usb interface is bound to the > driver, that pointer is going to be valid so there's no real need to > increment the reference count, except to feel good about doing it. > > I'll gladly do that fix instead, if you want me to, I was just trying to > follow the style of the existing code and fix up the current bug. Because I'm not much familiar with USB devices, I can't afford to the change that is too big to me. :) Let's take your version, so Acked-by: Ping-Ke Shih <pkshih@realtek.com> This patch can go via rtw-next tree (subtree of wireless-next), right? ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net] wifi: rtw88: properly drop usb interface reference on error 2026-02-24 1:49 ` Ping-Ke Shih @ 2026-02-24 6:18 ` Greg Kroah-Hartman 0 siblings, 0 replies; 7+ messages in thread From: Greg Kroah-Hartman @ 2026-02-24 6:18 UTC (permalink / raw) To: Ping-Ke Shih Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, stable On Tue, Feb 24, 2026 at 01:49:24AM +0000, Ping-Ke Shih wrote: > Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > > On Tue, Feb 24, 2026 at 12:46:02AM +0000, Ping-Ke Shih wrote: > > > Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > > > > If an error happens in the usb probe path, in rtw_usb_intf_init(), the > > > > usb interface reference needs to be properly dropped, otherwise is is > > > > incorrectly increased when returning to the USB core. > > > > > > > > Cc: Ping-Ke Shih <pkshih@realtek.com> > > > > Cc: stable <stable@kernel.org> > > > > Assisted-by: gkh_clanker_2000 > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > > > --- > > > > drivers/net/wireless/realtek/rtw88/usb.c | 8 ++++++-- > > > > 1 file changed, 6 insertions(+), 2 deletions(-) > > > > > > > > diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c > > > > index 433b06c8d8a6..36ac20039ce2 100644 > > > > --- a/drivers/net/wireless/realtek/rtw88/usb.c > > > > +++ b/drivers/net/wireless/realtek/rtw88/usb.c > > > > @@ -1046,13 +1046,17 @@ static int rtw_usb_intf_init(struct rtw_dev *rtwdev, > > > > > > > > rtwusb->udev = udev; > > > > ret = rtw_usb_parse(rtwdev, intf); > > > > - if (ret) > > > > + if (ret) { > > > > + usb_put_dev(udev); > > > > return ret; > > > > + } > > > > > > > > rtwusb->usb_data = kcalloc(RTW_USB_MAX_RXTX_COUNT, sizeof(u32), > > > > GFP_KERNEL); > > > > - if (!rtwusb->usb_data) > > > > + if (!rtwusb->usb_data) { > > > > + usb_put_dev(udev); > > > > return -ENOMEM; > > > > + } > > > > > > > > usb_set_intfdata(intf, rtwdev->hw); > > > > > > > > > > Since rtwusb->udev isn't used right after assignment in this function. > > > Would it be simpler that moving usb_get_dev() downward like below? > > > > What is even simpler, and easier, is to never call usb_get_dev() at all > > anyway as it's not needed :) > > > > I created that pattern a few decades ago when we thought that it was > > going to be required, but as long as the usb interface is bound to the > > driver, that pointer is going to be valid so there's no real need to > > increment the reference count, except to feel good about doing it. > > > > I'll gladly do that fix instead, if you want me to, I was just trying to > > follow the style of the existing code and fix up the current bug. > > Because I'm not much familiar with USB devices, I can't afford to the change > that is too big to me. :) > > Let's take your version, so > > Acked-by: Ping-Ke Shih <pkshih@realtek.com> Great, thanks! > This patch can go via rtw-next tree (subtree of wireless-next), right? Sure, please do so. thanks, greg k-h ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net] wifi: rtw88: properly drop usb interface reference on error 2026-02-23 11:37 [PATCH net] wifi: rtw88: properly drop usb interface reference on error Greg Kroah-Hartman 2026-02-24 0:46 ` Ping-Ke Shih @ 2026-03-03 3:07 ` Ping-Ke Shih 2026-03-09 0:43 ` Ping-Ke Shih 1 sibling, 1 reply; 7+ messages in thread From: Ping-Ke Shih @ 2026-03-03 3:07 UTC (permalink / raw) To: Greg Kroah-Hartman, linux-wireless Cc: linux-kernel, Greg Kroah-Hartman, Ping-Ke Shih, stable Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > If an error happens in the usb probe path, in rtw_usb_intf_init(), the > usb interface reference needs to be properly dropped, otherwise is is > incorrectly increased when returning to the USB core. > > Cc: Ping-Ke Shih <pkshih@realtek.com> > Cc: stable <stable@kernel.org> > Assisted-by: gkh_clanker_2000 > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > Acked-by: Ping-Ke Shih <pkshih@realtek.com> 1 patch(es) applied to rtw-next branch of rtw.git, thanks. c413737effd6 wifi: rtw88: properly drop usb interface reference on error --- https://github.com/pkshih/rtw.git ^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: [PATCH net] wifi: rtw88: properly drop usb interface reference on error 2026-03-03 3:07 ` Ping-Ke Shih @ 2026-03-09 0:43 ` Ping-Ke Shih 0 siblings, 0 replies; 7+ messages in thread From: Ping-Ke Shih @ 2026-03-09 0:43 UTC (permalink / raw) To: Ping-Ke Shih, Greg Kroah-Hartman, linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman, stable Ping-Ke Shih <pkshih@realtek.com> wrote: > > Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > > > If an error happens in the usb probe path, in rtw_usb_intf_init(), the > > usb interface reference needs to be properly dropped, otherwise is is > > incorrectly increased when returning to the USB core. > > > > Cc: Ping-Ke Shih <pkshih@realtek.com> > > Cc: stable <stable@kernel.org> > > Assisted-by: gkh_clanker_2000 > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > Acked-by: Ping-Ke Shih <pkshih@realtek.com> > > 1 patch(es) applied to rtw-next branch of rtw.git, thanks. > > c413737effd6 wifi: rtw88: properly drop usb interface reference on error > As Johan shared patchset and discussion in [1], drop this patch. [1] https://lore.kernel.org/linux-wireless/2026030625-wrongness-preorder-4e1e@gregkh/ ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-03-09 0:43 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-02-23 11:37 [PATCH net] wifi: rtw88: properly drop usb interface reference on error Greg Kroah-Hartman 2026-02-24 0:46 ` Ping-Ke Shih 2026-02-24 1:09 ` Greg Kroah-Hartman 2026-02-24 1:49 ` Ping-Ke Shih 2026-02-24 6:18 ` Greg Kroah-Hartman 2026-03-03 3:07 ` Ping-Ke Shih 2026-03-09 0:43 ` Ping-Ke Shih
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox