Ganapathi Bhat <gbhat@xxxxxxxxxxx> wrote: > Race condition is observed during rmmod of mwifiex_usb: > > 1. The rmmod thread will call mwifiex_usb_disconnect(), download > SHUTDOWN command and do wait_event_interruptible_timeout(), > waiting for response. > > 2. The main thread will handle the response and will do a > wake_up_interruptible(), unblocking rmmod thread. > > 3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in > mwifiex_usb_free(). > > 4. The main thread will try to resubmit rx_cmd.urb in > mwifiex_usb_submit_rx_urb(), which is NULL. > > To fix, wait for main thread to complete before calling > mwifiex_usb_free(). > > Signed-off-by: Ganapathi Bhat <gbhat@xxxxxxxxxxx> Patch applied to wireless-drivers-next.git, thanks. b817047ae70c mwifiex: handle race during mwifiex_usb_disconnect -- https://patchwork.kernel.org/patch/10424763/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
