RE: Crash when rmmod the rtw88_8723cs driver

[Ping-Ke Shih <pkshih@xxxxxxxxxxx>]

Hi Peter,

> 
> # rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core
> [ 3698.067354] wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local
> choice (Reason: 3=DEAUTH_LEAVING)
> [ 3698.300937] ------------[ cut here ]------------
> [ 3698.305987] Have pending ack frames!

I think that is because TX skb isn't acked to mac80211. Please apply below 
changes to see if it can fix the problem.


diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c
index 763aa8212a4b..7b1ec5ba80e6 100644
--- a/drivers/net/wireless/realtek/rtw88/sdio.c
+++ b/drivers/net/wireless/realtek/rtw88/sdio.c
@@ -1297,7 +1297,7 @@ static void rtw_sdio_deinit_tx(struct rtw_dev *rtwdev)
        int i;

        for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)
-               skb_queue_purge(&rtwsdio->tx_queue[i]);
+               ieee80211_purge_tx_queue(rtwdev->hw, &rtwsdio->tx_queue[i]);

        flush_workqueue(rtwsdio->txwq);
        destroy_workqueue(rtwsdio->txwq);
diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index 9145c11a063e..e6b244135ca3 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -423,10 +423,11 @@ static void rtw_usb_tx_handler(struct work_struct *work)

 static void rtw_usb_tx_queue_purge(struct rtw_usb *rtwusb)
 {
+       struct rtw_dev *rtwdev = rtwusb->rtwdev;
        int i;

        for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++)
-               skb_queue_purge(&rtwusb->tx_queue[i]);
+               ieee80211_purge_tx_queue(rtwdev->hw, &rtwusb->tx_queue[i]);
 }

 static void rtw_usb_write_port_complete(struct urb *urb)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 0a04eaf5343c..f11844f0c80f 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3180,6 +3180,17 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  */
 void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);

+/**
+ * ieee80211_purge_tx_queue - purge TX skb queue
+ * @hw: the hardware
+ * @skbs: the skbs
+ *
+ * Free a set of transmit skbs. Use this function when device is going to stop
+ * but some transmit skbs without TX status are still queued.
+ */
+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
+                             struct sk_buff_head *skbs);
+
 /**
  * DOC: Hardware crypto acceleration
  *
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index dd8f857a1fbc..d1cf987de13b 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -1301,3 +1301,4 @@ void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
        while ((skb = __skb_dequeue(skbs)))
                ieee80211_free_txskb(hw, skb);
 }
+EXPORT_SYMBOL(ieee80211_purge_tx_queue);