| From 4b9d883a73b28a81cbd831ba99d7ad8b2fa492b5 Mon Sep 17 00:00:00 2001 |
| From: Guenter Roeck <linux@roeck-us.net> |
| Date: Tue, 28 Jan 2020 14:14:57 -0800 |
| Subject: [PATCH] brcmfmac: abort and release host after error |
| |
| commit 863844ee3bd38219c88e82966d1df36a77716f3e upstream. |
| |
| With commit 216b44000ada ("brcmfmac: Fix use after free in |
| brcmf_sdio_readframes()") applied, we see locking timeouts in |
| brcmf_sdio_watchdog_thread(). |
| |
| brcmfmac: brcmf_escan_timeout: timer expired |
| INFO: task brcmf_wdog/mmc1:621 blocked for more than 120 seconds. |
| Not tainted 4.19.94-07984-g24ff99a0f713 #1 |
| "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. |
| brcmf_wdog/mmc1 D 0 621 2 0x00000000 last_sleep: 2440793077. last_runnable: 2440766827 |
| [<c0aa1e60>] (__schedule) from [<c0aa2100>] (schedule+0x98/0xc4) |
| [<c0aa2100>] (schedule) from [<c0853830>] (__mmc_claim_host+0x154/0x274) |
| [<c0853830>] (__mmc_claim_host) from [<bf10c5b8>] (brcmf_sdio_watchdog_thread+0x1b0/0x1f8 [brcmfmac]) |
| [<bf10c5b8>] (brcmf_sdio_watchdog_thread [brcmfmac]) from [<c02570b8>] (kthread+0x178/0x180) |
| |
| In addition to restarting or exiting the loop, it is also necessary to |
| abort the command and to release the host. |
| |
| Fixes: 216b44000ada ("brcmfmac: Fix use after free in brcmf_sdio_readframes()") |
| Cc: Dan Carpenter <dan.carpenter@oracle.com> |
| Cc: Matthias Kaehlcke <mka@chromium.org> |
| Cc: Brian Norris <briannorris@chromium.org> |
| Cc: Douglas Anderson <dianders@chromium.org> |
| Signed-off-by: Guenter Roeck <linux@roeck-us.net> |
| Reviewed-by: Douglas Anderson <dianders@chromium.org> |
| Acked-by: franky.lin@broadcom.com |
| Acked-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
| index cf6179b00e4c..ea8df8f6a790 100644 |
| --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
| +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
| @@ -1945,6 +1945,8 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes) |
| if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new, |
| BRCMF_SDIO_FT_NORMAL)) { |
| rd->len = 0; |
| + brcmf_sdio_rxfail(bus, true, true); |
| + sdio_release_host(bus->sdiodev->func1); |
| brcmu_pkt_buf_free_skb(pkt); |
| continue; |
| } |
| -- |
| 2.7.4 |
| |