Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   <Ajay.Kathat@microchip.com>
To:     <linux-wireless@vger.kernel.org>
CC:     <Claudiu.Beznea@microchip.com>, <Sripad.Balwadgi@microchip.com>,
        <Ajay.Kathat@microchip.com>, <mwalle@kernel.org>
Subject: [PATCH] wifi: wilc1000: fix kernel oops during interface down during
 background scan
Thread-Topic: [PATCH] wifi: wilc1000: fix kernel oops during interface down
 during background scan
Thread-Index: AQHZZpOxdxNIPScHF0Gh2r71RWeobA==
Date:   Tue, 4 Apr 2023 01:20:50 +0000
Message-ID: <20230404012010.15261-1-ajay.kathat@microchip.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?tsAKE0JaHSunb0cs7NnobFyPEMoVihQOj4W0g1R2j2mcY645cIxVR6X0Hj?=
 =?iso-8859-1?Q?nrcl1+2hFtk4LsqOsFP9Mj0JPL9gL3eCz3Qw/hX3E+P2gO4T77o4Cto2Gp?=
 =?iso-8859-1?Q?77yQ/KAxOiSeJuZySKsRjfgbwD2bbk1RU5dc4NppiEQASaBNgH7aCtAKTm?=
 =?iso-8859-1?Q?tW5+kLVZWgFeENhttIjZZ0UIJ6I7aURLbTC8CtRKK3wcemJfMVh/ZHcZ3z?=
 =?iso-8859-1?Q?OhEbWaJ4g62/7r2r//qmskRqninB7NesQxq9prU5euAX7BcdgPGIDWKu1r?=
 =?iso-8859-1?Q?Miz+IqPeK7ErRWWq3zI3wveShr2DkPjVlGbUMP676K8vyto6Byho4fcyfP?=
 =?iso-8859-1?Q?VbJV9uKfdUQAxN0TZivymoELvDvjcqrdSnM8OHtpGXNspxJkiWZFE0t3UF?=
 =?iso-8859-1?Q?dlWj6Iw1MP4l3seHB+aHMfWEucNAM8lQKDtILAxe88RCTYYZeMixas2rIB?=
 =?iso-8859-1?Q?Q8+/RcTvsKFlixYZufWYVEmeOz6aBjS8mO0HTt75uQwq1TV4UZDwprZMeB?=
 =?iso-8859-1?Q?Zp7V128AH8FCWJanixSUcysRxv7B1uuU+I6jdYDiEjPSbkEFjXZUYpoets?=
 =?iso-8859-1?Q?02RxNxzhoFDxTIPY5yWDd5qqMEGIWsnVNYSdDV1kdwCP9A7ylSDbJsRcz/?=
 =?iso-8859-1?Q?OpIVduMkHrSOkwF0CxpYXlM8xjNg5Go0nFM1jXW7fL6Ku/cMnN2EFvcxoY?=
 =?iso-8859-1?Q?MA/9zlYwX8+GUA5/6g1kGpNtZVcpYmzEa++uslkaemrpBh7n1QuNipmCMA?=
 =?iso-8859-1?Q?KEvwNzRyqL7A1h9qenpWMX0gMNATda9Ugjd40JWPdhb4IREFAjAF8+wP3I?=
 =?iso-8859-1?Q?DIxFATZ1A2xRdiILxRN9GY5VZ392ySFnwiA6cJ1p3za/BXh8OOL2STDDdA?=
 =?iso-8859-1?Q?i6cspyP9Co1Inb8i6anBWTRaSFm7GcQdrGE1/BZqeubpPOdjqFxCALjEEU?=
 =?iso-8859-1?Q?LbCiQFt00RFdKmz2oYQjcXsftN8AGxkHGS61Yp3Ds6Wet1n7ny7EIJhnKH?=
 =?iso-8859-1?Q?zDo7sii3aCC9K1Ysw+E+EHxH5kRCqRFsYaI0kMHdU1VI6FQlpOiPo6fTnh?=
 =?iso-8859-1?Q?mbKFeQgPdc8SYcHBc8RDgWhnw6zDzYa3QyUXMjbEoUfuggLofItKtuifvQ?=
 =?iso-8859-1?Q?6NlWdrHmUEOkQ8ZFOMOesZeQYD9+b7Rh4wjmYLqAjQQUVAFpcUl9Zuc2ED?=
 =?iso-8859-1?Q?9CNcNf/NZeiHoxBPok0VkOgb1InkItm4g/yWDBbIDlTGfMQ3nwcnuXLecJ?=
 =?iso-8859-1?Q?UQO5sjv9bp6z3FWfc7wh7snAdgfLfiI1B9QqjEioTBdTg+T3MssCQguQrg?=
 =?iso-8859-1?Q?lnGwjAxdo0ItP4EUJhzI1yI5GBO6xVoGzJLDHnFTBCpnl+IFQjnZmiY+2L?=
 =?iso-8859-1?Q?JH11RW4WWMQqi/iQ0qP2YeZFjk6+XNhCDXKi6/rC2iB10E0MNLtyFQ1Zip?=
 =?iso-8859-1?Q?jGm32aXKMYEY0lrZZXVY9Xd7Nl7rj8grYQrpeNKaEA8hxCYmxZQG35jC1o?=
 =?iso-8859-1?Q?DL6bYVorAtcj/TOYhygYvQsKD8GRfSGgL5bzAd8mJIL8rK+BI1IwxBV4uD?=
 =?iso-8859-1?Q?Aoc+PagJGSQbMyuF+po0lEA8t3KIMoU7MTXrXPOmbM3Buc98uVxtMmQRsb?=
 =?iso-8859-1?Q?tx+BdJpazEJnmtQ8TtfHSuQ7L9zaFR61BXjfidDKFNGMFlLda2im8/hw?=
 =?iso-8859-1?Q?=3D=3D?=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB5176.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c81b66e0-0ce3-4f21-ccee-08db34aad388
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Apr 2023 01:20:50.0631
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 3f4057f3-b418-4d4e-ba84-d55b4e897d88
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Pmq8WPcWxWMkhqDLS+4S7fWKaJ9ncUHDWHdcwgLvsfJR4s/x4qbK143+RoZwtQFxVQ2xdF1ecAl4edz2gdh6UezbsXI9ddUzI7Rbb7hMQ4g=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW3PR11MB4572
X-Spam-Status: No, score=-2.5 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
        DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H2,
        SPF_HELO_PASS,SPF_PASS autolearn=unavailable autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Fix for kernel crash observed with following test procedure [1]:
  while true;
    do ifconfig wlan0 up;
    iw dev wlan0 scan &
    ifconfig wlan0 down;
  done

During the above test procedure, the scan results are received from firmwar=
e
for 'iw scan' command gets queued even when the interface is going down. It
was causing the kernel oops when dereferencing the freed pointers.

For synchronization, 'mac_close()' calls flush_workqueue() to block its
execution till all pending work is completed. Afterwards 'wilc->close' flag
which is set before the flush_workqueue() should avoid adding new work.
Added 'wilc->close' check in wilc_handle_isr() which is common for
SPI/SDIO bus to ignore the interrupts from firmware that inturns adds the
work since the interface is getting closed.

1. https://lore.kernel.org/linux-wireless/20221024135407.7udo3dwl3mqyv2yj@0=
002.3ffe.de/

Reported-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
---
 drivers/net/wireless/microchip/wilc1000/netdev.c | 9 +++------
 drivers/net/wireless/microchip/wilc1000/wlan.c   | 3 +++
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net=
/wireless/microchip/wilc1000/netdev.c
index e9f59de31b0b..40edee10a81f 100644
--- a/drivers/net/wireless/microchip/wilc1000/netdev.c
+++ b/drivers/net/wireless/microchip/wilc1000/netdev.c
@@ -38,11 +38,6 @@ static irqreturn_t isr_bh_routine(int irq, void *userdat=
a)
 {
 	struct wilc *wilc =3D userdata;

-	if (wilc->close) {
-		pr_err("Can't handle BH interrupt\n");
-		return IRQ_HANDLED;
-	}
-
 	wilc_handle_isr(wilc);

 	return IRQ_HANDLED;
@@ -781,13 +776,15 @@ static int wilc_mac_close(struct net_device *ndev)
 	if (vif->ndev) {
 		netif_stop_queue(vif->ndev);

+		if (wl->open_ifcs =3D=3D 0)
+			wl->close =3D 1;
+
 		wilc_handle_disconnect(vif);
 		wilc_deinit_host_int(vif->ndev);
 	}

 	if (wl->open_ifcs =3D=3D 0) {
 		netdev_dbg(ndev, "Deinitializing wilc1000\n");
-		wl->close =3D 1;
 		wilc_wlan_deinitialize(ndev);
 	}

diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.c b/drivers/net/w=
ireless/microchip/wilc1000/wlan.c
index 58bbf50081e4..700cb657be00 100644
--- a/drivers/net/wireless/microchip/wilc1000/wlan.c
+++ b/drivers/net/wireless/microchip/wilc1000/wlan.c
@@ -1066,6 +1066,9 @@ void wilc_handle_isr(struct wilc *wilc)
 {
 	u32 int_status;

+	if (wilc->close)
+		return;
+
 	acquire_bus(wilc, WILC_BUS_ACQUIRE_AND_WAKEUP);
 	wilc->hif_func->hif_read_int(wilc, &int_status);

--
2.34.1