From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>,
Matthias Kaehlcke <mka@chromium.org>,
Brian Norris <briannorris@chromium.org>,
Douglas Anderson <dianders@chromium.org>,
Guenter Roeck <linux@roeck-us.net>,
franky.lin@broadcom.com, Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.6 10/29] brcmfmac: abort and release host after error
Date: Tue, 7 Apr 2020 12:22:07 +0200 [thread overview]
Message-ID: <20200407101453.241931574@linuxfoundation.org> (raw)
In-Reply-To: <20200407101452.046058399@linuxfoundation.org>
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 863844ee3bd38219c88e82966d1df36a77716f3e ]
With commit 216b44000ada ("brcmfmac: Fix use after free in
brcmf_sdio_readframes()") applied, we see locking timeouts in
brcmf_sdio_watchdog_thread().
brcmfmac: brcmf_escan_timeout: timer expired
INFO: task brcmf_wdog/mmc1:621 blocked for more than 120 seconds.
Not tainted 4.19.94-07984-g24ff99a0f713 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
brcmf_wdog/mmc1 D 0 621 2 0x00000000 last_sleep: 2440793077. last_runnable: 2440766827
[<c0aa1e60>] (__schedule) from [<c0aa2100>] (schedule+0x98/0xc4)
[<c0aa2100>] (schedule) from [<c0853830>] (__mmc_claim_host+0x154/0x274)
[<c0853830>] (__mmc_claim_host) from [<bf10c5b8>] (brcmf_sdio_watchdog_thread+0x1b0/0x1f8 [brcmfmac])
[<bf10c5b8>] (brcmf_sdio_watchdog_thread [brcmfmac]) from [<c02570b8>] (kthread+0x178/0x180)
In addition to restarting or exiting the loop, it is also necessary to
abort the command and to release the host.
Fixes: 216b44000ada ("brcmfmac: Fix use after free in brcmf_sdio_readframes()")
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Matthias Kaehlcke <mka@chromium.org>
Cc: Brian Norris <briannorris@chromium.org>
Cc: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Acked-by: franky.lin@broadcom.com
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index f9047db6a11d8..3a08252f1a53f 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -1938,6 +1938,8 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
BRCMF_SDIO_FT_NORMAL)) {
rd->len = 0;
+ brcmf_sdio_rxfail(bus, true, true);
+ sdio_release_host(bus->sdiodev->func1);
brcmu_pkt_buf_free_skb(pkt);
continue;
}
--
2.20.1
next prev parent reply other threads:[~2020-04-07 10:26 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-07 10:21 [PATCH 5.6 00/29] 5.6.3-rc1 review Greg Kroah-Hartman
2020-04-07 10:21 ` [PATCH 5.6 01/29] ipv4: fix a RCU-list lock in fib_triestat_seq_show Greg Kroah-Hartman
2020-04-07 10:21 ` [PATCH 5.6 02/29] net: dsa: ksz: Select KSZ protocol tag Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 03/29] net, ip_tunnel: fix interface lookup with no key Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 04/29] sctp: fix possibly using a bad saddr with a given dst Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 05/29] sctp: fix refcount bug in sctp_wfree Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 06/29] net: macb: Fix handling of fixed-link node Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 07/29] net: fix fraglist segmentation reference count leak Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 08/29] udp: initialize is_flist with 0 in udp_gro_receive Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 09/29] padata: fix uninitialized return value in padata_replace() Greg Kroah-Hartman
2020-04-07 10:22 ` Greg Kroah-Hartman [this message]
2020-04-07 10:22 ` [PATCH 5.6 11/29] bpf: Fix tnum constraints for 32-bit comparisons Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 12/29] XArray: Fix xa_find_next for large multi-index entries Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 13/29] drm/bridge: analogix-anx6345: Avoid duplicate -supply suffix Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 14/29] drm/i915/display: Fix mode private_flags comparison at atomic_check Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 15/29] misc: rtsx: set correct pcr_ops for rts522A Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 16/29] misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 17/29] misc: pci_endpoint_test: Avoid using module parameter to determine irqtype Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 18/29] PCI: sysfs: Revert "rescan" file renames Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 19/29] coresight: do not use the BIT() macro in the UAPI header Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 20/29] mei: me: add cedar fork device ids Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 21/29] nvmem: release the write-protect pin Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 22/29] nvmem: check for NULL reg_read and reg_write before dereferencing Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 23/29] nvmem: sprd: Fix the block lock operation Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 24/29] extcon: axp288: Add wakeup support Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 25/29] power: supply: axp288_charger: Add special handling for HP Pavilion x2 10 Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 26/29] Revert "ALSA: uapi: Drop asound.h inclusion from asoc.h" Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 27/29] Revert "dm: always call blk_queue_split() in dm_process_bio()" Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 28/29] ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard Greg Kroah-Hartman
2020-04-07 10:22 ` [PATCH 5.6 29/29] soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper Greg Kroah-Hartman
2020-04-07 12:37 ` [PATCH 5.6 00/29] 5.6.3-rc1 review Jon Hunter
2020-04-07 14:49 ` Greg Kroah-Hartman
2020-04-07 13:51 ` Daniel Díaz
2020-04-07 14:43 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200407101453.241931574@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=briannorris@chromium.org \
--cc=dan.carpenter@oracle.com \
--cc=dianders@chromium.org \
--cc=franky.lin@broadcom.com \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=mka@chromium.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).