2023-06-15 11:09:14

by Dmitry Antipov

Subject: [PATCH] wifi: rtw89: delete timer and free skb queue when unloading

Delete TX purge timer and free C2H queue in 'rtw_core_deinit()'.

Signed-off-by: Dmitry Antipov <[email protected]>
---
drivers/net/wireless/realtek/rtw88/main.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index 9447a3aae3b5..572fc126b9de 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -2180,9 +2180,11 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
release_firmware(wow_fw->firmware);

destroy_workqueue(rtwdev->tx_wq);
+ timer_delete_sync(&rtwdev->tx_report.purge_timer);
spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
skb_queue_purge(&rtwdev->tx_report.queue);
skb_queue_purge(&rtwdev->coex.queue);
+ skb_queue_purge(&rtwdev->c2h_queue);
spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);

list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
--
2.40.1

2023-06-15 12:17:12

by Kalle Valo

Subject: Re: [PATCH] wifi: rtw89: delete timer and free skb queue when unloading

Dmitry Antipov <[email protected]> writes:

> Delete TX purge timer and free C2H queue in 'rtw_core_deinit()'.

The commit log should always answer to the question "Why?". Please
explain in the commit log why this is needed.

--
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

2023-06-15 15:29:03

by Dmitry Antipov

Subject: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading

Fix possible crash and memory leak on driver unload by deleting
TX purge timer and freeing C2H queue in 'rtw_core_deinit()'.

Signed-off-by: Dmitry Antipov <[email protected]>
---
v2: fix title and commit message (Kalle Valo)
---
drivers/net/wireless/realtek/rtw88/main.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index 9447a3aae3b5..572fc126b9de 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -2180,9 +2180,11 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
release_firmware(wow_fw->firmware);

destroy_workqueue(rtwdev->tx_wq);
+ timer_delete_sync(&rtwdev->tx_report.purge_timer);
spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
skb_queue_purge(&rtwdev->tx_report.queue);
skb_queue_purge(&rtwdev->coex.queue);
+ skb_queue_purge(&rtwdev->c2h_queue);
spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);

list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
--
2.40.1

2023-06-16 01:20:17

by Ping-Ke Shih

Subject: RE: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading

> -----Original Message-----
> From: Dmitry Antipov <[email protected]>
> Sent: Thursday, June 15, 2023 11:19 PM
> To: Kalle Valo <[email protected]>
> Cc: Yan-Hsuan Chuang <[email protected]>; [email protected]; Dmitry Antipov
> <[email protected]>
> Subject: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading
>
> Fix possible crash and memory leak on driver unload by deleting
> TX purge timer and freeing C2H queue in 'rtw_core_deinit()'.
>
> Signed-off-by: Dmitry Antipov <[email protected]>
> ---
> v2: fix title and commit message (Kalle Valo)
> ---
> drivers/net/wireless/realtek/rtw88/main.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
> index 9447a3aae3b5..572fc126b9de 100644
> --- a/drivers/net/wireless/realtek/rtw88/main.c
> +++ b/drivers/net/wireless/realtek/rtw88/main.c
> @@ -2180,9 +2180,11 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
> release_firmware(wow_fw->firmware);
>
> destroy_workqueue(rtwdev->tx_wq);
> + timer_delete_sync(&rtwdev->tx_report.purge_timer);
> spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
> skb_queue_purge(&rtwdev->tx_report.queue);
> skb_queue_purge(&rtwdev->coex.queue);
> + skb_queue_purge(&rtwdev->c2h_queue);

rtwdev->tx_report.q_lock is used to protect rtwdev->tx_report.queue, so don't
add to purge c2h queue in this critical section. I think coex.queue is
the bad example.

> spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);
>
> list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
> --
> 2.40.1