Received-SPF: pass (google.com: domain of linux-wireless+bounces-8137-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Kalle Valo <kvalo@kernel.org>
To: marcin.slusarz@gmail.com
Cc: linux-wireless@vger.kernel.org,  Marcin =?utf-8?Q?=C5=9Alusarz?=
 <mslusarz@renau.com>,
  Ping-Ke Shih <pkshih@realtek.com>,  Larry Finger
 <Larry.Finger@lwfinger.net>,  linux-kernel@vger.kernel.org
Subject: Re: [PATCH] wifi: rtw88: schedule rx work after everything is set up
References: <20240527170137.455671-1-marcin.slusarz@gmail.com>
Date: Mon, 27 May 2024 20:17:31 +0300
In-Reply-To: <20240527170137.455671-1-marcin.slusarz@gmail.com> (marcin
	slusarz's message of "Mon, 27 May 2024 19:01:37 +0200")
Message-ID: <87jzjf8990.fsf@kernel.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

marcin.slusarz@gmail.com writes:

> From: Marcin =C5=9Alusarz <mslusarz@renau.com>
>
> Right now it's possible to hit NULL pointer dereference in
> rtw_rx_fill_rx_status on hw object and/or its fields because
> initialization routine can start getting USB replies before
> rtw_dev is fully setup.
>
> The stack trace looks like this:
>
> rtw_rx_fill_rx_status
> rtw8821c_query_rx_desc
> rtw_usb_rx_handler
> ...
> queue_work
> rtw_usb_read_port_complete
> ...
> usb_submit_urb
> rtw_usb_rx_resubmit
> rtw_usb_init_rx
> rtw_usb_probe
>
> So while we do the async stuff rtw_usb_probe continues and calls
> rtw_register_hw, which does all kinds of initialization (e.g.
> via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.
>
> Fix this by moving the first usb_submit_urb after everything
> is set up.
>
> For me, this bug manifested as:
> [    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
> [    8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_f=
ill_rx_status
> because I'm using Larry's backport of rtw88 driver with the NULL
> checks in rtw_rx_fill_rx_status.
>
> This should fix:
> https://marc.info/?l=3Dlinux-wireless&m=3D167907688311943&w=3D2

Please use permalinks from lore.kernel.org, marc links don't contain the
Message-Id and are hence unreliable.

--=20
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatc=
hes