releases/4.14.60/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch

   1 From foo@baz Sat Jul 28 10:25:26 CEST 2018
   2 From: Ganapathi Bhat <gbhat@marvell.com>
   3 Date: Thu, 24 May 2018 19:18:27 +0530
   4 Subject: mwifiex: handle race during mwifiex_usb_disconnect
   5
   6 From: Ganapathi Bhat <gbhat@marvell.com>
   7
   8 [ Upstream commit b817047ae70c0bd67b677b65d0d69d72cd6e9728 ]
   9
  10 Race condition is observed during rmmod of mwifiex_usb:
  11
  12 1. The rmmod thread will call mwifiex_usb_disconnect(), download
  13    SHUTDOWN command and do wait_event_interruptible_timeout(),
  14    waiting for response.
  15
  16 2. The main thread will handle the response and will do a
  17    wake_up_interruptible(), unblocking rmmod thread.
  18
  19 3. On getting unblocked, rmmod thread  will make rx_cmd.urb = NULL in
  20    mwifiex_usb_free().
  21
  22 4. The main thread will try to resubmit rx_cmd.urb in
  23    mwifiex_usb_submit_rx_urb(), which is NULL.
  24
  25 To fix, wait for main thread to complete before calling
  26 mwifiex_usb_free().
  27
  28 Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
  29 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  30 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  31 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  32 ---
  33  drivers/net/wireless/marvell/mwifiex/usb.c |    3 +++
  34  1 file changed, 3 insertions(+)
  35
  36 --- a/drivers/net/wireless/marvell/mwifiex/usb.c
  37 +++ b/drivers/net/wireless/marvell/mwifiex/usb.c
  38 @@ -644,6 +644,9 @@ static void mwifiex_usb_disconnect(struc
  39                                          MWIFIEX_FUNC_SHUTDOWN);
  40         }
  41
  42 +       if (adapter->workqueue)
  43 +               flush_workqueue(adapter->workqueue);
  44 +
  45         mwifiex_usb_free(card);
  46
  47         mwifiex_dbg(adapter, FATAL,