Received-SPF: pass (google.com: domain of linux-kernel+bounces-164824-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+2660b9135e6144ca41a5@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [wireless?] [usb?] INFO: trying to register non-static key in skb_dequeue (3)
Date: Wed,  1 May 2024 08:05:14 +0800
Message-Id: <20240501000514.1552-1-hdanton@sina.com>
In-Reply-To: <0000000000006ca6cc061751a86a@google.com>
References: 
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Tue, 30 Apr 2024 08:02:25 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    3f12222a4beb usb: dwc3: core: Fix compile warning on s390 ..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=118eeccf180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git  usb-testing

--- x/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ y/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -171,6 +171,7 @@ static int _rtl_usb_init_tx(struct ieee8
 	u32 i;
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
+	int err = 0;
 
 	rtlusb->max_bulk_out_size = IS_HIGH_SPEED_USB(rtlusb->udev)
 						    ? USB_HIGH_SPEED_BULK_SIZE
@@ -185,7 +186,8 @@ static int _rtl_usb_init_tx(struct ieee8
 		if (!ep_num) {
 			rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
 				"Invalid endpoint map setting!\n");
-			return -EINVAL;
+			err = -EINVAL;
+			break;
 		}
 	}
 
@@ -203,7 +205,7 @@ static int _rtl_usb_init_tx(struct ieee8
 		skb_queue_head_init(&rtlusb->tx_skb_queue[i]);
 		init_usb_anchor(&rtlusb->tx_pending[i]);
 	}
-	return 0;
+	return err;
 }
 
 static void _rtl_rx_work(struct tasklet_struct *t);
@@ -236,7 +238,7 @@ static int _rtl_usb_init(struct ieee8021
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_usb_priv *usb_priv = rtl_usbpriv(hw);
 	struct rtl_usb *rtlusb = rtl_usbdev(usb_priv);
-	int err;
+	int err, rc;
 	u8 epidx;
 	struct usb_interface	*usb_intf = rtlusb->intf;
 	u8 epnums = usb_intf->cur_altsetting->desc.bNumEndpoints;
@@ -286,7 +288,9 @@ static int _rtl_usb_init(struct ieee8021
 	/* usb endpoint mapping */
 	err = rtlpriv->cfg->usb_interface_cfg->usb_endpoint_mapping(hw);
 	rtlusb->usb_mq_to_hwq =  rtlpriv->cfg->usb_interface_cfg->usb_mq_to_hwq;
-	_rtl_usb_init_tx(hw);
+	rc = _rtl_usb_init_tx(hw);
+	if (!err)
+		err = rc;
 	_rtl_usb_init_rx(hw);
 	return err;
 }
--