Re: [usb?] WARNING: ODEBUG bug in corrupted (3)

From: Lizhi Xu
Date: Fri Oct 11 2024 - 22:47:43 EST


rtl delayed work not be canceled before put usb device, it trigger following issue:
ODEBUG: free active (active state 0) object: ffff88811dc037c8 object type: timer_list hint: rtl_ips_nic_off_wq_callback+0x0/0x680

#syz test

diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index aab4605de9c4..c6e4a5e59880 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -472,7 +472,10 @@ static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
{
struct rtl_priv *rtlpriv = rtl_priv(hw);
+ static char deinit = 0;

+ if (deinit)
+ return;
del_timer_sync(&rtlpriv->works.watchdog_timer);

cancel_delayed_work_sync(&rtlpriv->works.watchdog_wq);
@@ -484,6 +487,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
cancel_delayed_work_sync(&rtlpriv->works.ps_rfon_wq);
cancel_delayed_work_sync(&rtlpriv->works.fwevt_wq);
cancel_delayed_work_sync(&rtlpriv->works.c2hcmd_wq);
+ deinit = 1;
}
EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);

diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index d37a017b2b81..aaa16bc23e91 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1064,9 +1064,9 @@ void rtl_usb_disconnect(struct usb_interface *intf)
ieee80211_unregister_hw(hw);
rtlmac->mac80211_registered = 0;
} else {
- rtl_deinit_deferred_work(hw, false);
rtlpriv->intf_ops->adapter_stop(hw);
}
+ rtl_deinit_deferred_work(hw, false);
/*deinit rfkill */
/* rtl_deinit_rfkill(hw); */
rtl_usb_deinit(hw);