[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <670a7a68.050a0220.4cbc0.0022.GAE@google.com>
Date: Sat, 12 Oct 2024 06:32:24 -0700
From: syzbot <syzbot+90f31ac02b7ae5e8b578@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] Re: [usb?] WARNING: ODEBUG bug in corrupted (3)
For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.
***
Subject: Re: [usb?] WARNING: ODEBUG bug in corrupted (3)
Author: lizhi.xu@...driver.com
rtl delayed work not be canceled before put usb device, it trigger following issue:
ODEBUG: free active (active state 0) object: ffff88811dc037c8 object type: timer_list hint: rtl_ips_nic_off_wq_callback+0x0/0x680
#syz test
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index aab4605de9c4..605875d21573 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -449,6 +449,7 @@ static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
if (!wq)
return -ENOMEM;
+ set_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status);
/* <1> timer */
timer_setup(&rtlpriv->works.watchdog_timer,
rtl_watch_dog_timer_callback, 0);
@@ -473,6 +474,9 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
{
struct rtl_priv *rtlpriv = rtl_priv(hw);
+ if (!test_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status))
+ return;
+
del_timer_sync(&rtlpriv->works.watchdog_timer);
cancel_delayed_work_sync(&rtlpriv->works.watchdog_wq);
@@ -484,6 +488,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
cancel_delayed_work_sync(&rtlpriv->works.ps_rfon_wq);
cancel_delayed_work_sync(&rtlpriv->works.fwevt_wq);
cancel_delayed_work_sync(&rtlpriv->works.c2hcmd_wq);
+ clear_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status);
}
EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index d37a017b2b81..aaa16bc23e91 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1064,9 +1064,9 @@ void rtl_usb_disconnect(struct usb_interface *intf)
ieee80211_unregister_hw(hw);
rtlmac->mac80211_registered = 0;
} else {
- rtl_deinit_deferred_work(hw, false);
rtlpriv->intf_ops->adapter_stop(hw);
}
+ rtl_deinit_deferred_work(hw, false);
/*deinit rfkill */
/* rtl_deinit_rfkill(hw); */
rtl_usb_deinit(hw);
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index ae6e351bc83c..24d3dcbdf81c 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -322,6 +322,7 @@ enum rt_eeprom_type {
enum ttl_status {
RTL_STATUS_INTERFACE_START = 0,
+ RTL_STATUS_WORK_SETUP = 1,
};
enum hardware_type {
Powered by blists - more mailing lists