Re: [PATCH] wifi: rtw88: schedule rx work after everything is set up

[Ping-Ke Shih]

On Tue, 2024-05-28 at 13:02 +0200, Marcin Ślusarz wrote:
> 
> From: Marcin Ślusarz <mslusarz@xxxxxxxxx>
> 
> Right now it's possible to hit NULL pointer dereference in
> rtw_rx_fill_rx_status on hw object and/or its fields because
> initialization routine can start getting USB replies before
> rtw_dev is fully setup.
> 
> The stack trace looks like this:
> 
> rtw_rx_fill_rx_status
> rtw8821c_query_rx_desc
> rtw_usb_rx_handler
> ...
> queue_work
> rtw_usb_read_port_complete
> ...
> usb_submit_urb
> rtw_usb_rx_resubmit
> rtw_usb_init_rx
> rtw_usb_probe
> 
> So while we do the async stuff rtw_usb_probe continues and calls
> rtw_register_hw, which does all kinds of initialization (e.g.
> via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.
> 
> Fix this by moving the first usb_submit_urb after everything
> is set up.
> 
> For me, this bug manifested as:
> [    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
> [    8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status
> because I'm using Larry's backport of rtw88 driver with the NULL
> checks in rtw_rx_fill_rx_status.
> 
> Reported-by: Tim K <tpkuester@xxxxxxxxx>
> Closes: 
> https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa--NiVVx494WcuQw@xxxxxxxxxxxxxx/

Change Closes to Link during committing because of no ACK from Tim.

> Signed-off-by: Marcin Ślusarz <mslusarz@xxxxxxxxx>
> Cc: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
> Cc: Larry Finger <Larry.Finger@xxxxxxxxxxxx>
> Cc: Kalle Valo <kvalo@xxxxxxxxxx>
> Cc: linux-wireless@xxxxxxxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx
> 

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

adc539784c98 wifi: rtw88: usb: schedule rx work after everything is set up

---
https://github.com/pkshih/rtw.git