From patchwork Thu Aug 6 10:26:13 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amitkumar Karwar X-Patchwork-Id: 6957691 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id A0C3A9F6E2 for ; Thu, 6 Aug 2015 10:27:31 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A95252065E for ; Thu, 6 Aug 2015 10:27:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 824172053D for ; Thu, 6 Aug 2015 10:27:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754981AbbHFK10 (ORCPT ); Thu, 6 Aug 2015 06:27:26 -0400 Received: from mx0a-0016f401.pphosted.com ([67.231.148.174]:11998 "EHLO mx0a-0016f401.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752865AbbHFK1X (ORCPT ); Thu, 6 Aug 2015 06:27:23 -0400 Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.15.0.59/8.15.0.59) with SMTP id t76AOt9Y002661; Thu, 6 Aug 2015 03:27:15 -0700 Received: from sc-exch02.marvell.com ([199.233.58.182]) by mx0a-0016f401.pphosted.com with ESMTP id 1w3t9dsv3y-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Thu, 06 Aug 2015 03:27:15 -0700 Received: from SC-EXCH03.marvell.com (10.93.176.83) by SC-EXCH02.marvell.com (10.93.176.82) with Microsoft SMTP Server (TLS) id 15.0.1044.25; Thu, 6 Aug 2015 03:27:14 -0700 Received: from maili.marvell.com (10.93.176.43) by SC-EXCH03.marvell.com (10.93.176.83) with Microsoft SMTP Server id 15.0.1044.25 via Frontend Transport; Thu, 6 Aug 2015 03:27:14 -0700 Received: from pe-lt101 (unknown [10.31.130.100]) by maili.marvell.com (Postfix) with ESMTP id AF2223F7040; Thu, 6 Aug 2015 03:27:13 -0700 (PDT) Received: from pe-lt101 (pe-lt077 [127.0.0.1]) by pe-lt101 (8.14.4/8.14.4) with ESMTP id t76AQRZf003695; Thu, 6 Aug 2015 03:26:28 -0700 Received: (from root@localhost) by pe-lt101 (8.14.4/8.14.4/Submit) id t76AQQEW003694; Thu, 6 Aug 2015 03:26:26 -0700 From: Amitkumar Karwar To: CC: Cathy Luo , Nishant Sarmukadam , , Reyad Attiyat , Kalle Valo Subject: [PATCH 4.2 1/3] mwifiex: usb: Fix double add error when submitting rx urb Date: Thu, 6 Aug 2015 03:26:13 -0700 Message-ID: <1438856775-3666-1-git-send-email-akarwar@marvell.com> X-Mailer: git-send-email 1.7.3.4 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2015-08-06_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=inbound_notspam policy=inbound score=0 kscore.is_bulkscore=0 kscore.compositescore=1 compositescore=0.9 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 kscore.is_spamscore=0 rbsscore=0.9 spamscore=0 urlsuspectscore=0.9 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1506180000 definitions=main-1508060173 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-7.0 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Reyad Attiyat There is an error that can occur where the driver adds the same URB to USB submission list twice. This happens since mwifiex_usb_submit_rem_rx can submit packets at same time as an rx urb complete callback. This causes list corruption and is fixed by not setting the skb to NULL when submitting an rx packet. [ 84.461242] WARNING: CPU: 1 PID: 748 at lib/list_debug.c:36 __list_add+0xcb/0xd0() [ 84.461245] list_add double add: new=ffff8800c92b0c50, prev=ffff8800c92b0c50, next=ffff8800ced6c430. [ 84.461247] Modules linked in: rfcomm fuse cmac nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack bnep iptable_mangle iptable_security iptable_raw btusb btintel bluetooth mwifiex_usb mwifiex x86_pkg_temp_thermal cfg80211 coretemp r8712u(C) kvm_intel kvm hid_sensor_als hid_sensor_incl_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_accel_3d hid_sensor_gyro_3d hid_sensor_trigger hid_sensor_iio_common industrialio_triggered_buffer kfifo_buf rfkill iTCO_wdt industrialio iTCO_vendor_support [ 84.461316] crc32_pclmul crc32c_intel ghash_clmulni_intel microcode snd_hda_codec_realtek vfat snd_hda_codec_generic fat snd_hda_codec_hdmi snd_hda_intel snd_hda_controller uvcvideo snd_hda_codec videobuf2_vmalloc videobuf2_memops snd_hwdep videobuf2_core snd_hda_core joydev v4l2_common videodev hid_sensor_hub snd_seq hid_multitouch media snd_seq_device snd_pcm snd_timer mei_me snd i2c_i801 lpc_ich mei soundcore tpm_infineon tpm_tis tpm i2c_hid i2c_designware_platform i2c_designware_core nfsd auth_rpcgss nfs_acl lockd grace sunrpc sch_fq_codel i915 i2c_algo_bit drm_kms_helper drm xhci_pci xhci_hcd ehci_pci sd_mod ehci_hcd video [ 84.461383] CPU: 1 PID: 748 Comm: kworker/u9:0 Tainted: G C 4.1.0-rc5+ #163 [ 84.461386] Hardware name: Microsoft Corporation Surface Pro 2/Surface Pro 2, BIOS 2.05.0250 04/10/2015 [ 84.461396] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex] [ 84.461399] ffffffff81a8150e ffff8801174cf8e8 ffffffff817df830 0000000000000000 [ 84.461405] ffff8801174cf938 ffff8801174cf928 ffffffff810a54ba ffff8800c86bd750 [ 84.461410] ffff8800c92b0c50 ffff8800c92b0c50 ffff8800ced6c430 ffff88010c057178 [ 84.461416] Call Trace: [ 84.461421] [] dump_stack+0x4f/0x7b [ 84.461428] [] warn_slowpath_common+0x8a/0xc0 [ 84.461432] [] warn_slowpath_fmt+0x46/0x50 [ 84.461436] [] __list_add+0xcb/0xd0 [ 84.461442] [] ? usb_hcd_link_urb_to_ep+0x2a/0xa0 [ 84.461446] [] usb_hcd_link_urb_to_ep+0x80/0xa0 [ 84.461459] [] prepare_transfer+0xaa/0x130 [xhci_hcd] [ 84.461470] [] xhci_queue_bulk_tx+0xb7/0x7a0 [xhci_hcd] [ 84.461480] [] ? xhci_urb_enqueue+0x50f/0x660 [xhci_hcd] [ 84.461489] [] ? xhci_urb_enqueue+0x50f/0x660 [xhci_hcd] [ 84.461498] [] xhci_urb_enqueue+0x5c5/0x660 [xhci_hcd] [ 84.461503] [] usb_hcd_submit_urb+0x93/0xa70 [ 84.461507] [] ? __alloc_skb+0x78/0x1f0 [ 84.461511] [] ? __kmalloc_reserve.isra.26+0x31/0x90 [ 84.461515] [] ? __alloc_skb+0x4c/0x1f0 [ 84.461519] [] ? __alloc_skb+0x8c/0x1f0 [ 84.461523] [] ? skb_dequeue+0x5d/0x80 [ 84.461527] [] usb_submit_urb+0x42e/0x5f0 [ 84.461531] [] ? __alloc_rx_skb+0x39/0x100 [ 84.461536] [] mwifiex_usb_submit_rx_urb+0xb2/0x170 [mwifiex_usb] [ 84.461542] [] mwifiex_usb_submit_rem_rx_urbs+0x45/0x50 [mwifiex_usb] [ 84.461550] [] mwifiex_rx_work_queue+0x10e/0x140 [mwifiex] [ 84.461556] [] process_one_work+0x229/0x890 [ 84.461559] [] ? process_one_work+0x18c/0x890 [ 84.461565] [] worker_thread+0x53/0x470 [ 84.461569] [] ? process_one_work+0x890/0x890 [ 84.461572] [] kthread+0xf2/0x110 [ 84.461577] [] ? trace_hardirqs_on+0xd/0x10 [ 84.461581] [] ? kthread_create_on_node+0x230/0x230 [ 84.461586] [] ret_from_fork+0x42/0x70 [ 84.461590] [] ? kthread_create_on_node+0x230/0x230 [ 84.461593] ---[ end trace 65103af5e6fb3444 ]--- Cc: stable@vger.kernel.org # 3.19+ Signed-off-by: Reyad Attiyat Acked-by: Amitkumar Karwar Signed-off-by: Kalle Valo --- drivers/net/wireless/mwifiex/usb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c index aada934..fbad99c 100644 --- a/drivers/net/wireless/mwifiex/usb.c +++ b/drivers/net/wireless/mwifiex/usb.c @@ -244,9 +244,11 @@ setup_for_next: if (card->rx_cmd_ep == context->ep) { mwifiex_usb_submit_rx_urb(context, size); } else { - context->skb = NULL; - if (atomic_read(&adapter->rx_pending) <= HIGH_RX_PENDING) + if (atomic_read(&adapter->rx_pending) <= HIGH_RX_PENDING){ mwifiex_usb_submit_rx_urb(context, size); + }else{ + context->skb = NULL; + } } return;