Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Authenticated-By: 
From:   Ping-Ke Shih <pkshih@realtek.com>
To:     Dmitry Antipov <dmantipov@yandex.ru>, Kalle Valo <kvalo@kernel.org>
CC:     Yan-Hsuan Chuang <tony0620emma@gmail.com>,
        "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Subject: RE: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading
Thread-Topic: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when
 unloading
Thread-Index: AQHZn5zgajoIIGul30uNrZf2KgsQxa+MmiZw
Date:   Fri, 16 Jun 2023 01:11:10 +0000
Message-ID: <5fb6969687da47b2a12cb35041accca2@realtek.com>
References: <87leglaqkl.fsf@kernel.org>
 <20230615151911.5793-1-dmantipov@yandex.ru>
In-Reply-To: <20230615151911.5793-1-dmantipov@yandex.ru>
Accept-Language: en-US, zh-TW
Content-Language: zh-TW
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
Precedence: bulk


> -----Original Message-----
> From: Dmitry Antipov <dmantipov@yandex.ru>
> Sent: Thursday, June 15, 2023 11:19 PM
> To: Kalle Valo <kvalo@kernel.org>
> Cc: Yan-Hsuan Chuang <tony0620emma@gmail.com>; linux-wireless@vger.kernel.org; Dmitry Antipov
> <dmantipov@yandex.ru>
> Subject: [PATCH] [v2] wifi: rtw88: delete timer and free skb queue when unloading
> 
> Fix possible crash and memory leak on driver unload by deleting
> TX purge timer and freeing C2H queue in 'rtw_core_deinit()'.
> 
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
> v2: fix title and commit message (Kalle Valo)
> ---
>  drivers/net/wireless/realtek/rtw88/main.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
> index 9447a3aae3b5..572fc126b9de 100644
> --- a/drivers/net/wireless/realtek/rtw88/main.c
> +++ b/drivers/net/wireless/realtek/rtw88/main.c
> @@ -2180,9 +2180,11 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)
>                 release_firmware(wow_fw->firmware);
> 
>         destroy_workqueue(rtwdev->tx_wq);
> +       timer_delete_sync(&rtwdev->tx_report.purge_timer);
>         spin_lock_irqsave(&rtwdev->tx_report.q_lock, flags);
>         skb_queue_purge(&rtwdev->tx_report.queue);
>         skb_queue_purge(&rtwdev->coex.queue);
> +       skb_queue_purge(&rtwdev->c2h_queue);

rtwdev->tx_report.q_lock is used to protect rtwdev->tx_report.queue, so don't
add to purge c2h queue in this critical section. I think coex.queue is
the bad example.

>         spin_unlock_irqrestore(&rtwdev->tx_report.q_lock, flags);
> 
>         list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
> --
> 2.40.1