diff options
| author | Ganapathi Bhat <gbhat@marvell.com> | 2018-05-24 16:48:27 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2018-05-29 10:22:57 +0300 |
| commit | b817047ae70c0bd67b677b65d0d69d72cd6e9728 (patch) | |
| tree | a526dc62165ef7cd4b4c89e19ce569665d704b4d /drivers/net/wireless | |
| parent | 618fd1ed17d4cf193d85747c04a8b836b8fc107e (diff) | |
| download | linux-b817047ae70c0bd67b677b65d0d69d72cd6e9728.tar.xz | |
mwifiex: handle race during mwifiex_usb_disconnect
Race condition is observed during rmmod of mwifiex_usb:
1. The rmmod thread will call mwifiex_usb_disconnect(), download
SHUTDOWN command and do wait_event_interruptible_timeout(),
waiting for response.
2. The main thread will handle the response and will do a
wake_up_interruptible(), unblocking rmmod thread.
3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in
mwifiex_usb_free().
4. The main thread will try to resubmit rx_cmd.urb in
mwifiex_usb_submit_rx_urb(), which is NULL.
To fix, wait for main thread to complete before calling
mwifiex_usb_free().
Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/usb.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c index bc475b83bb15..6e3cf9817730 100644 --- a/drivers/net/wireless/marvell/mwifiex/usb.c +++ b/drivers/net/wireless/marvell/mwifiex/usb.c @@ -644,6 +644,9 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf) MWIFIEX_FUNC_SHUTDOWN); } + if (adapter->workqueue) + flush_workqueue(adapter->workqueue); + mwifiex_usb_free(card); mwifiex_dbg(adapter, FATAL, |