From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mathy Vanhoef Subject: [PATCH] brcmfmac: unlink URB when request timed out Date: Sun, 09 Nov 2014 13:10:13 -0500 Message-ID: <545FAE05.2030701@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit To: brudley-dY08KVG/lbpWk0Htik3J/w@public.gmane.org, arend-dY08KVG/lbpWk0Htik3J/w@public.gmane.org, frankyl-dY08KVG/lbpWk0Htik3J/w@public.gmane.org, meuleman-dY08KVG/lbpWk0Htik3J/w@public.gmane.org, linville-2XuSBdqkA4R54TAoqtyWWQ@public.gmane.org, pieterpg-dY08KVG/lbpWk0Htik3J/w@public.gmane.org, linux-wireless-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, brcm80211-dev-list-dY08KVG/lbpWk0Htik3J/w@public.gmane.org, netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Return-path: Sender: linux-wireless-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: netdev.vger.kernel.org From: Mathy Vanhoef Unlink the submitted URB in brcmf_usb_dl_cmd if the request timed out. This assures the URB is never submitted twice, preventing a driver crash. Signed-off-by: Mathy Vanhoef --- Currently brcmfmac may crash when a USB device is attached (tested with a LG TWFM-B003D). In particular it fails on the second call to brcmf_usb_dl_cmd in the while loop of brcmf_usb_resetcfg. The problem is that an URB is being submitted twice: [ 169.861800] brcmfmac: brcmf_usb_dl_writeimage Enter, fw f14db000, len 348160 [ 171.787791] brcmfmac: brcmf_usb_dl_writeimage Exit, err=0 [ 171.787797] brcmfmac: brcmf_usb_dlstart Exit, err=0 [ 171.787799] brcmfmac: brcmf_usb_dlrun Enter [ 171.791794] brcmfmac: brcmf_usb_resetcfg Enter [ 173.988072] ------------[ cut here ]------------ [ 173.988083] WARNING: CPU: 0 PID: 369 at drivers/usb/core/urb.c:339 usb_submit_urb+0x4e6/0x500() [ 173.988085] URB eaf45f00 submitted while active [ 173.988086] Modules linked in: brcmfmac brcmutil vmw_pvscsi pcnet32 mptspi mptscsih mptbase [ 173.988100] CPU: 0 PID: 369 Comm: kworker/0:2 Not tainted 3.18.0-rc3-wl #1 [ 173.988102] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 173.988106] Workqueue: events request_firmware_work_func [ 173.988108] 00000000 00000000 ee747db8 c1711f4a ee747df8 ee747de8 c103edaf c18d1e10 [ 173.988112] ee747e14 00000171 c18a8b29 00000153 c1490556 c1490556 eaf45f00 eafdc660 [ 173.988115] f14b8fa0 ee747e00 c103ee4e 00000009 ee747df8 c18d1e10 ee747e14 ee747e50 [ 173.988119] Call Trace: [ 173.988129] [] dump_stack+0x41/0x52 [ 173.988136] [] warn_slowpath_common+0x7f/0xa0 [ 173.988139] [] ? usb_submit_urb+0x4e6/0x500 [ 173.988141] [] ? usb_submit_urb+0x4e6/0x500 [ 173.988147] [] ? brcmf_usb_ioctl_resp_wake+0x40/0x40 [brcmfmac] [ 173.988150] [] warn_slowpath_fmt+0x2e/0x30 [ 173.988152] [] usb_submit_urb+0x4e6/0x500 [ 173.988156] [] ? __kmalloc+0x21/0x140 [ 173.988161] [] ? brcmf_usb_dl_cmd+0x33/0x120 [brcmfmac] [ 173.988166] [] brcmf_usb_dl_cmd+0xb3/0x120 [brcmfmac] [ 173.988170] [] brcmf_usb_probe_phase2+0x4e4/0x640 [brcmfmac] [ 173.988176] [] brcmf_fw_request_code_done+0xd0/0xf0 [brcmfmac] [ 173.988178] [] request_firmware_work_func+0x26/0x50 [ 173.988182] [] process_one_work+0x11e/0x360 [ 173.988184] [] worker_thread+0xf0/0x3c0 [ 173.988205] [] ? __wake_up_locked+0x1a/0x20 [ 173.988208] [] ? process_scheduled_works+0x30/0x30 [ 173.988211] [] kthread+0x96/0xb0 [ 173.988214] [] ret_from_kernel_thread+0x21/0x30 [ 173.988217] [] ? kthread_worker_fn+0x110/0x110 [ 173.988219] ---[ end trace 0c88bf46801de083 ]--- [ 173.988221] brcmf_usb_dl_cmd: usb_submit_urb failed -16 [ 173.988396] brcmfmac: brcmf_usb_probe_phase2 failed: dev=1-1, err=-19 [ 173.989503] brcmfmac: brcmf_usb_disconnect Enter This patch fixes the brcmf_usb_dl_cmd function to prevent an URB from being submitted twice. Tested using a LG TWFM-B003D, which now works properly. drivers/net/wireless/brcm80211/brcmfmac/usb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c index 5265aa7..1bc7858 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c @@ -738,10 +738,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd, goto finalize; } - if (!brcmf_usb_ioctl_resp_wait(devinfo)) + if (!brcmf_usb_ioctl_resp_wait(devinfo)) { + usb_unlink_urb(devinfo->ctl_urb); ret = -ETIMEDOUT; - else + } else { memcpy(buffer, tmpbuf, buflen); + } finalize: kfree(tmpbuf); -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html