RE: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading

[Ping-Ke Shih <pkshih@realtek.com>]

> -----Original Message-----
> From: Dmitry Antipov <dmantipov@yandex.ru>
> Sent: Thursday, June 15, 2023 11:19 PM
> To: Kalle Valo <kvalo@kernel.org>
> Cc: Yan-Hsuan Chuang <tony0620emma@gmail.com>; linux-wireless@vger.kernel.org; Dmitry Antipov
> <dmantipov@yandex.ru>
> Subject: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading
> 
> Fix possible crash and memory leak on driver unload by deleting
> TX purge timer and freeing C2H queue in 'rtw_core_deinit()'.
> 
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
> v2: fix title and commit message (Kalle Valo)
> ---
>  drivers/net/wireless/realtek/rtw88/main.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
> index 9447a3aae3b5..572fc126b9de 100644
> --- a/drivers/net/wireless/realtek/rtw88/main.c
> +++ b/drivers/net/wireless/realtek/rtw88/main.c
> @@ -2180,9 +2180,11 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
>                 release_firmware(wow_fw->firmware);
> 
>         destroy_workqueue(rtwdev->tx_wq);
> +       timer_delete_sync(&rtwdev->tx_report.purge_timer);
>         spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
>         skb_queue_purge(&rtwdev->tx_report.queue);
>         skb_queue_purge(&rtwdev->coex.queue);
> +       skb_queue_purge(&rtwdev->c2h_queue);

rtwdev->tx_report.q_lock is used to protect rtwdev->tx_report.queue, so don't
add to purge c2h queue in this critical section. I think coex.queue is
the bad example.

>         spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);
> 
>         list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
> --
> 2.40.1