git.openwrt.org Git - openwrt/staging/ldir.git/blob

   1 From 25eaef533bf3ccc6fee5067aac16f41f280e343e Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Marcin=20=C5=9Alusarz?= <mslusarz@renau.com>
   3 Date: Tue, 28 May 2024 13:02:46 +0200
   4 Subject: [PATCH] wifi: rtw88: usb: schedule rx work after everything is set up
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 [ Upstream commit adc539784c98a7cc602cbf557debfc2e7b9be8b3 ]
  10
  11 Right now it's possible to hit NULL pointer dereference in
  12 rtw_rx_fill_rx_status on hw object and/or its fields because
  13 initialization routine can start getting USB replies before
  14 rtw_dev is fully setup.
  15
  16 The stack trace looks like this:
  17
  18 rtw_rx_fill_rx_status
  19 rtw8821c_query_rx_desc
  20 rtw_usb_rx_handler
  21 ...
  22 queue_work
  23 rtw_usb_read_port_complete
  24 ...
  25 usb_submit_urb
  26 rtw_usb_rx_resubmit
  27 rtw_usb_init_rx
  28 rtw_usb_probe
  29
  30 So while we do the async stuff rtw_usb_probe continues and calls
  31 rtw_register_hw, which does all kinds of initialization (e.g.
  32 via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.
  33
  34 Fix this by moving the first usb_submit_urb after everything
  35 is set up.
  36
  37 For me, this bug manifested as:
  38 [    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
  39 [    8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status
  40 because I'm using Larry's backport of rtw88 driver with the NULL
  41 checks in rtw_rx_fill_rx_status.
  42
  43 Link: https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa--NiVVx494WcuQw@mail.gmail.com/
  44 Signed-off-by: Marcin Ślusarz <mslusarz@renau.com>
  45 Cc: Tim K <tpkuester@gmail.com>
  46 Cc: Ping-Ke Shih <pkshih@realtek.com>
  47 Cc: Larry Finger <Larry.Finger@lwfinger.net>
  48 Cc: Kalle Valo <kvalo@kernel.org>
  49 Cc: linux-wireless@vger.kernel.org
  50 Cc: linux-kernel@vger.kernel.org
  51 Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
  52 Link: https://patch.msgid.link/20240528110246.477321-1-marcin.slusarz@gmail.com
  53 Signed-off-by: Sasha Levin <sashal@kernel.org>
  54 ---
  55  drivers/net/wireless/realtek/rtw88/usb.c | 13 ++++++++++---
  56  1 file changed, 10 insertions(+), 3 deletions(-)
  57
  58 --- a/drivers/net/wireless/realtek/rtw88/usb.c
  59 +++ b/drivers/net/wireless/realtek/rtw88/usb.c
  60 @@ -740,7 +740,6 @@ static struct rtw_hci_ops rtw_usb_ops =
  61  static int rtw_usb_init_rx(struct rtw_dev *rtwdev)
  62  {
  63         struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
  64 -       int i;
  65
  66         rtwusb->rxwq = create_singlethread_workqueue("rtw88_usb: rx wq");
  67         if (!rtwusb->rxwq) {
  68 @@ -752,13 +751,19 @@ static int rtw_usb_init_rx(struct rtw_de
  69
  70         INIT_WORK(&rtwusb->rx_work, rtw_usb_rx_handler);
  71
  72 +       return 0;
  73 +}
  74 +
  75 +static void rtw_usb_setup_rx(struct rtw_dev *rtwdev)
  76 +{
  77 +       struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
  78 +       int i;
  79 +
  80         for (i = 0; i < RTW_USB_RXCB_NUM; i++) {
  81                 struct rx_usb_ctrl_block *rxcb = &rtwusb->rx_cb[i];
  82
  83                 rtw_usb_rx_resubmit(rtwusb, rxcb);
  84         }
  85 -
  86 -       return 0;
  87  }
  88
  89  static void rtw_usb_deinit_rx(struct rtw_dev *rtwdev)
  90 @@ -895,6 +900,8 @@ int rtw_usb_probe(struct usb_interface *
  91                 goto err_destroy_rxwq;
  92         }
  93
  94 +       rtw_usb_setup_rx(rtwdev);
  95 +
  96         return 0;
  97
  98  err_destroy_rxwq: