[PATCH] wifi: rtw89: delete timer and free skb queue when unloading

[PATCH] wifi: rtw89: delete timer and free skb queue when unloading

[Dmitry Antipov]

Delete TX purge timer and free C2H queue in 'rtw_core_deinit()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 drivers/net/wireless/realtek/rtw88/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index 9447a3aae3b5..572fc126b9de 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -2180,9 +2180,11 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
 		release_firmware(wow_fw->firmware);
 
 	destroy_workqueue(rtwdev->tx_wq);
+	timer_delete_sync(&rtwdev->tx_report.purge_timer);
 	spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
 	skb_queue_purge(&rtwdev->tx_report.queue);
 	skb_queue_purge(&rtwdev->coex.queue);
+	skb_queue_purge(&rtwdev->c2h_queue);
 	spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);
 
 	list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
-- 
2.40.1

Re: [PATCH] wifi: rtw89: delete timer and free skb queue when unloading

[Kalle Valo]

Dmitry Antipov <dmantipov@yandex.ru> writes:

> Delete TX purge timer and free C2H queue in 'rtw_core_deinit()'.

The commit log should always answer to the question "Why?". Please
explain in the commit log why this is needed.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

[PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading

[Dmitry Antipov]

Fix possible crash and memory leak on driver unload by deleting
TX purge timer and freeing C2H queue in 'rtw_core_deinit()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
v2: fix title and commit message (Kalle Valo)
---
 drivers/net/wireless/realtek/rtw88/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index 9447a3aae3b5..572fc126b9de 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -2180,9 +2180,11 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
 		release_firmware(wow_fw->firmware);
 
 	destroy_workqueue(rtwdev->tx_wq);
+	timer_delete_sync(&rtwdev->tx_report.purge_timer);
 	spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
 	skb_queue_purge(&rtwdev->tx_report.queue);
 	skb_queue_purge(&rtwdev->coex.queue);
+	skb_queue_purge(&rtwdev->c2h_queue);
 	spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);
 
 	list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
-- 
2.40.1

RE: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading

[Ping-Ke Shih]

> -----Original Message-----
> From: Dmitry Antipov <dmantipov@yandex.ru>
> Sent: Thursday, June 15, 2023 11:19 PM
> To: Kalle Valo <kvalo@kernel.org>
> Cc: Yan-Hsuan Chuang <tony0620emma@gmail.com>; linux-wireless@vger.kernel.org; Dmitry Antipov
> <dmantipov@yandex.ru>
> Subject: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading
> 
> Fix possible crash and memory leak on driver unload by deleting
> TX purge timer and freeing C2H queue in 'rtw_core_deinit()'.
> 
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
> v2: fix title and commit message (Kalle Valo)
> ---
>  drivers/net/wireless/realtek/rtw88/main.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
> index 9447a3aae3b5..572fc126b9de 100644
> --- a/drivers/net/wireless/realtek/rtw88/main.c
> +++ b/drivers/net/wireless/realtek/rtw88/main.c
> @@ -2180,9 +2180,11 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
>                 release_firmware(wow_fw->firmware);
> 
>         destroy_workqueue(rtwdev->tx_wq);
> +       timer_delete_sync(&rtwdev->tx_report.purge_timer);
>         spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
>         skb_queue_purge(&rtwdev->tx_report.queue);
>         skb_queue_purge(&rtwdev->coex.queue);
> +       skb_queue_purge(&rtwdev->c2h_queue);

rtwdev->tx_report.q_lock is used to protect rtwdev->tx_report.queue, so don't
add to purge c2h queue in this critical section. I think coex.queue is
the bad example.

>         spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);
> 
>         list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
> --
> 2.40.1