Commit f8c095f6 authored Jun 01, 2018 by Ganapathi Bhat Committed by Kalle Valo Jun 24, 2018

mwifiex: handle race during mwifiex_usb_disconnect



Race condition is observed during rmmod of mwifiex_usb:

1. The rmmod thread will call mwifiex_usb_disconnect(), download
   SHUTDOWN command and do wait_event_interruptible_timeout(),
   waiting for response.

2. The main thread will handle the response and will do a
   wake_up_interruptible(), unblocking rmmod thread.

3. On getting unblocked, rmmod thread  will make rx_cmd.urb = NULL in
   mwifiex_usb_free().

4. The main thread will try to resubmit rx_cmd.urb in
   mwifiex_usb_submit_rx_urb(), which is NULL.

To fix this, move mwifiex_usb_free() from mwifiex_usb_disconnect
to mwifiex_unregister_dev(). Function mwifiex_unregister_dev() is
called after flushing the command and RX work queues.

Suggested-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

parent 7e58e741

drivers/net/wireless/marvell/mwifiex/usb.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -644,8 +644,6 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
		MWIFIEX_FUNC_SHUTDOWN);
		}

		mwifiex_usb_free(card);

		mwifiex_dbg(adapter, FATAL,
		"%s: removing card\n", __func__);
		mwifiex_remove_card(adapter);
		@@ -1353,6 +1351,8 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
		{
		struct usb_card_rec card = (struct usb_card_rec )adapter->card;

		mwifiex_usb_free(card);

		mwifiex_usb_cleanup_tx_aggr(adapter);

		card->adapter = NULL;

Admin message