| From 8b6594485a036b3fee3b829587f8e7b69422795c Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 24 Jun 2020 04:16:07 -0500 |
| Subject: brcmfmac: set state of hanger slot to FREE when flushing PSQ |
| |
| From: Wright Feng <wright.feng@cypress.com> |
| |
| [ Upstream commit fcdd7a875def793c38d7369633af3eba6c7cf089 ] |
| |
| When USB or SDIO device got abnormal bus disconnection, host driver |
| tried to clean up the skbs in PSQ and TXQ (The skb's pointer in hanger |
| slot linked to PSQ and TSQ), so we should set the state of skb hanger slot |
| to BRCMF_FWS_HANGER_ITEM_STATE_FREE before freeing skb. |
| In brcmf_fws_bus_txq_cleanup it already sets |
| BRCMF_FWS_HANGER_ITEM_STATE_FREE before freeing skb, therefore we add the |
| same thing in brcmf_fws_psq_flush to avoid following warning message. |
| |
| [ 1580.012880] ------------ [ cut here ]------------ |
| [ 1580.017550] WARNING: CPU: 3 PID: 3065 at |
| drivers/net/wireless/broadcom/brcm80211/brcmutil/utils.c:49 |
| brcmu_pkt_buf_free_skb+0x21/0x30 [brcmutil] |
| [ 1580.184017] Call Trace: |
| [ 1580.186514] brcmf_fws_cleanup+0x14e/0x190 [brcmfmac] |
| [ 1580.191594] brcmf_fws_del_interface+0x70/0x90 [brcmfmac] |
| [ 1580.197029] brcmf_proto_bcdc_del_if+0xe/0x10 [brcmfmac] |
| [ 1580.202418] brcmf_remove_interface+0x69/0x190 [brcmfmac] |
| [ 1580.207888] brcmf_detach+0x90/0xe0 [brcmfmac] |
| [ 1580.212385] brcmf_usb_disconnect+0x76/0xb0 [brcmfmac] |
| [ 1580.217557] usb_unbind_interface+0x72/0x260 |
| [ 1580.221857] device_release_driver_internal+0x141/0x200 |
| [ 1580.227152] device_release_driver+0x12/0x20 |
| [ 1580.231460] bus_remove_device+0xfd/0x170 |
| [ 1580.235504] device_del+0x1d9/0x300 |
| [ 1580.239041] usb_disable_device+0x9e/0x270 |
| [ 1580.243160] usb_disconnect+0x94/0x270 |
| [ 1580.246980] hub_event+0x76d/0x13b0 |
| [ 1580.250499] process_one_work+0x144/0x360 |
| [ 1580.254564] worker_thread+0x4d/0x3c0 |
| [ 1580.258247] kthread+0x109/0x140 |
| [ 1580.261515] ? rescuer_thread+0x340/0x340 |
| [ 1580.265543] ? kthread_park+0x60/0x60 |
| [ 1580.269237] ? SyS_exit_group+0x14/0x20 |
| [ 1580.273118] ret_from_fork+0x25/0x30 |
| [ 1580.300446] ------------ [ cut here ]------------ |
| |
| Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> |
| Signed-off-by: Wright Feng <wright.feng@cypress.com> |
| Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Link: https://lore.kernel.org/r/20200624091608.25154-2-wright.feng@cypress.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c |
| index 8cc52935fd413..948840b4e38e3 100644 |
| --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c |
| +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c |
| @@ -643,6 +643,7 @@ static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h, |
| static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q, |
| int ifidx) |
| { |
| + struct brcmf_fws_hanger_item *hi; |
| bool (*matchfn)(struct sk_buff *, void *) = NULL; |
| struct sk_buff *skb; |
| int prec; |
| @@ -654,6 +655,9 @@ static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q, |
| skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx); |
| while (skb) { |
| hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT); |
| + hi = &fws->hanger.items[hslot]; |
| + WARN_ON(skb != hi->pkt); |
| + hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE; |
| brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, |
| true); |
| brcmu_pkt_buf_free_skb(skb); |
| -- |
| 2.25.1 |
| |