2
0

020-03-rt2x00usb-fix-anchor-initialization.patch 2.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475
  1. From 0488a6121dfe6cbd44de15ea3627913b7549a1e9 Mon Sep 17 00:00:00 2001
  2. From: Stanislaw Gruszka <sgruszka@redhat.com>
  3. Date: Wed, 8 Feb 2017 12:18:10 +0100
  4. Subject: [PATCH 03/19] rt2x00usb: fix anchor initialization
  5. If device fail to initialize we can OOPS in rt2x00lib_remove_dev(), due
  6. to using uninitialized usb_anchor structure:
  7. [ 855.435820] ieee80211 phy3: rt2x00usb_vendor_request: Error - Vendor Request 0x07 failed for offset 0x1000 with error -19
  8. [ 855.435826] ieee80211 phy3: rt2800_probe_rt: Error - Invalid RT chipset 0x0000, rev 0000 detected
  9. [ 855.435829] ieee80211 phy3: rt2x00lib_probe_dev: Error - Failed to allocate device
  10. [ 855.435845] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
  11. [ 855.435900] IP: _raw_spin_lock_irq+0xd/0x30
  12. [ 855.435926] PGD 0
  13. [ 855.435953] Oops: 0002 [#1] SMP
  14. <snip>
  15. [ 855.437011] Call Trace:
  16. [ 855.437029] ? usb_kill_anchored_urbs+0x27/0xc0
  17. [ 855.437061] rt2x00lib_remove_dev+0x190/0x1c0 [rt2x00lib]
  18. [ 855.437097] rt2x00lib_probe_dev+0x246/0x7a0 [rt2x00lib]
  19. [ 855.437149] ? ieee80211_roc_setup+0x9e/0xd0 [mac80211]
  20. [ 855.437183] ? __kmalloc+0x1af/0x1f0
  21. [ 855.437207] ? rt2x00usb_probe+0x13d/0xc50 [rt2x00usb]
  22. [ 855.437240] rt2x00usb_probe+0x155/0xc50 [rt2x00usb]
  23. [ 855.437273] rt2800usb_probe+0x15/0x20 [rt2800usb]
  24. [ 855.437304] usb_probe_interface+0x159/0x2d0
  25. [ 855.437333] driver_probe_device+0x2bb/0x460
  26. Patch changes initialization sequence to fix the problem.
  27. Cc: Vishal Thanki <vishalthanki@gmail.com>
  28. Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB")
  29. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
  30. Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  31. ---
  32. drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 13 ++++++++-----
  33. 1 file changed, 8 insertions(+), 5 deletions(-)
  34. diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
  35. index fe13dd07cc2a..c696f0ad6a68 100644
  36. --- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
  37. +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
  38. @@ -825,10 +825,6 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
  39. if (retval)
  40. goto exit_free_device;
  41. - retval = rt2x00lib_probe_dev(rt2x00dev);
  42. - if (retval)
  43. - goto exit_free_reg;
  44. -
  45. rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,
  46. sizeof(struct usb_anchor),
  47. GFP_KERNEL);
  48. @@ -836,10 +832,17 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
  49. retval = -ENOMEM;
  50. goto exit_free_reg;
  51. }
  52. -
  53. init_usb_anchor(rt2x00dev->anchor);
  54. +
  55. + retval = rt2x00lib_probe_dev(rt2x00dev);
  56. + if (retval)
  57. + goto exit_free_anchor;
  58. +
  59. return 0;
  60. +exit_free_anchor:
  61. + usb_kill_anchored_urbs(rt2x00dev->anchor);
  62. +
  63. exit_free_reg:
  64. rt2x00usb_free_reg(rt2x00dev);
  65. --
  66. 2.12.1