rtl delayed work not be canceled before put usb device, it trigger following issue: ODEBUG: free active (active state 0) object: ffff88811dc037c8 object type: timer_list hint: rtl_ips_nic_off_wq_callback+0x0/0x680 [ 135.350453][ C1] RIP: 0010:debug_print_object+0x1a3/0x2b0 [ 135.350498][ C1] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 48 8b 14 dd c0 fc 46 87 41 56 4c 89 e6 48 c7 c7 20 f0 46 87 e8 2e d5 c3 fe 90 <0f> 0b 90 90 58 83 05 ad 76 ff 07 01 48 83 c4 18 5b 5d 41 5c 41 5d [ 135.350532][ C1] RSP: 0018:ffffc90001adf418 EFLAGS: 00010282 [ 135.350562][ C1] RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff811ab159 [ 135.350585][ C1] RDX: ffff88811c061d40 RSI: ffffffff811ab166 RDI: 0000000000000001 [ 135.350609][ C1] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 135.350631][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8746f6c0 [ 135.350654][ C1] R13: ffffffff872a8e00 R14: ffffffff840306a0 R15: ffffc90001adf528 [ 135.351009][ C1] debug_check_no_obj_freed+0x4b8/0x600 [ 135.351194][ C1] __free_pages_ok+0x244/0xa20 [ 135.351262][ C1] __folio_put+0x1cd/0x250 [ 135.351527][ C1] device_release+0xa1/0x240 [ 135.351576][ C1] kobject_put+0x1e4/0x5a0 [ 135.351624][ C1] put_device+0x1f/0x30 [ 135.351669][ C1] rtl_usb_disconnect+0x41c/0x5a0 [ 135.351720][ C1] usb_unbind_interface+0x1e8/0x970 [ 135.351859][ C1] device_remove+0x122/0x170 [ 135.351895][ C1] device_release_driver_internal+0x44a/0x610 [ 135.351944][ C1] bus_remove_device+0x22f/0x420 [ 135.352003][ C1] device_del+0x396/0x9f0 [ 135.352138][ C1] usb_disable_device+0x36c/0x7f0 [ 135.352202][ C1] usb_disconnect+0x2e1/0x920 [ 135.352264][ C1] hub_event+0x1bed/0x4f40 [ 135.352778][ C1] process_one_work+0x9c5/0x1ba0 [ 135.353023][ C1] worker_thread+0x6c8/0xf00 [ 135.353193][ C1] kthread+0x2c1/0x3a0 [ 135.353313][ C1] ret_from_fork+0x45/0x80 [ 135.353406][ C1] ret_from_fork_asm+0x1a/0x30 [ 135.353474][ C1] </TASK> By moving the position of rtl_deinit_deferred_work() in rtl_usb_disconnect(), ensure that rtl_deinit_deferred_work() is executed before releasing the USB device. In addition, add a bit in "enum ttl_status" to indicate whether rtl_deinit_deferred_work() needs to be executed. It needs to be executed when set, otherwise it will not be executed. Reported-and-tested-by: syzbot+90f31ac02b7ae5e8b578@xxxxxxxxxxxxxxxxxxxxxxxxx Closes: https://syzkaller.appspot.com/bug?extid=90f31ac02b7ae5e8b578 Signed-off-by: Lizhi Xu <lizhi.xu@xxxxxxxxxxxxx> --- drivers/net/wireless/realtek/rtlwifi/base.c | 5 +++++ drivers/net/wireless/realtek/rtlwifi/usb.c | 2 +- drivers/net/wireless/realtek/rtlwifi/wifi.h | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c index aab4605de9c4..605875d21573 100644 --- a/drivers/net/wireless/realtek/rtlwifi/base.c +++ b/drivers/net/wireless/realtek/rtlwifi/base.c @@ -449,6 +449,7 @@ static int _rtl_init_deferred_work(struct ieee80211_hw *hw) if (!wq) return -ENOMEM; + set_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status); /* <1> timer */ timer_setup(&rtlpriv->works.watchdog_timer, rtl_watch_dog_timer_callback, 0); @@ -473,6 +474,9 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq) { struct rtl_priv *rtlpriv = rtl_priv(hw); + if (!test_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status)) + return; + del_timer_sync(&rtlpriv->works.watchdog_timer); cancel_delayed_work_sync(&rtlpriv->works.watchdog_wq); @@ -484,6 +488,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq) cancel_delayed_work_sync(&rtlpriv->works.ps_rfon_wq); cancel_delayed_work_sync(&rtlpriv->works.fwevt_wq); cancel_delayed_work_sync(&rtlpriv->works.c2hcmd_wq); + clear_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status); } EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work); diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c index d37a017b2b81..aaa16bc23e91 100644 --- a/drivers/net/wireless/realtek/rtlwifi/usb.c +++ b/drivers/net/wireless/realtek/rtlwifi/usb.c @@ -1064,9 +1064,9 @@ void rtl_usb_disconnect(struct usb_interface *intf) ieee80211_unregister_hw(hw); rtlmac->mac80211_registered = 0; } else { - rtl_deinit_deferred_work(hw, false); rtlpriv->intf_ops->adapter_stop(hw); } + rtl_deinit_deferred_work(hw, false); /*deinit rfkill */ /* rtl_deinit_rfkill(hw); */ rtl_usb_deinit(hw); diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h index ae6e351bc83c..24d3dcbdf81c 100644 --- a/drivers/net/wireless/realtek/rtlwifi/wifi.h +++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h @@ -322,6 +322,7 @@ enum rt_eeprom_type { enum ttl_status { RTL_STATUS_INTERFACE_START = 0, + RTL_STATUS_WORK_SETUP = 1, }; enum hardware_type { -- 2.43.0
