2023-06-28 08:25:37

by Dmitry Antipov

Subject: [PATCH 1/4] [v6] wifi: rtw88: delete timer and free skb queue when unloading

Fix possible crash and memory leak on driver unload by deleting
TX purge timer and freeing C2H queue in 'rtw_core_deinit()',
shrink critical section in the latter by freeing COEX queue
out of TX report lock scope.

Reviewed-by: Ping-Ke Shih <[email protected]>
Signed-off-by: Dmitry Antipov <[email protected]>
---
v6: adjust to match series
v5: adjust to match recent changes
v4: adjust to match series
v3: shrink critical section in rtw_core_deinit() (Ping-Ke Shih)
v2: fix title and commit message (Kalle Valo)
---
drivers/net/wireless/realtek/rtw88/main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index c853e2f2d448..c2ddb4d382af 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -2183,10 +2183,12 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
release_firmware(wow_fw->firmware);

destroy_workqueue(rtwdev->tx_wq);
+ timer_delete_sync(&rtwdev->tx_report.purge_timer);
spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
skb_queue_purge(&rtwdev->tx_report.queue);
- skb_queue_purge(&rtwdev->coex.queue);
spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);
+ skb_queue_purge(&rtwdev->coex.queue);
+ skb_queue_purge(&rtwdev->c2h_queue);

list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
build_list) {
--
2.41.0

2023-07-25 14:47:06

by Kalle Valo

Subject: Re: [PATCH 1/4] [v6] wifi: rtw88: delete timer and free skb queue when unloading

Dmitry Antipov <[email protected]> wrote:

> Fix possible crash and memory leak on driver unload by deleting
> TX purge timer and freeing C2H queue in 'rtw_core_deinit()',
> shrink critical section in the latter by freeing COEX queue
> out of TX report lock scope.
>
> Reviewed-by: Ping-Ke Shih <[email protected]>
> Signed-off-by: Dmitry Antipov <[email protected]>

4 patches applied to wireless-next.git, thanks.

634fcbcaa406 wifi: rtw88: delete timer and free skb queue when unloading
6ca25a31e0a8 wifi: rtw88: remove unused and set but unused leftovers
e88c9558951f wifi: rtw88: remove unused USB bulkout size set
8986f0a9a3bb wifi: rtw88: simplify vif iterators

--
https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches