package/kernel/mac80211/patches/020-03-rt2x00usb-fix-anchor-initialization.patch

   1 From 0488a6121dfe6cbd44de15ea3627913b7549a1e9 Mon Sep 17 00:00:00 2001
   2 From: Stanislaw Gruszka <sgruszka@redhat.com>
   3 Date: Wed, 8 Feb 2017 12:18:10 +0100
   4 Subject: [PATCH 03/19] rt2x00usb: fix anchor initialization
   5
   6 If device fail to initialize we can OOPS in rt2x00lib_remove_dev(), due
   7 to using uninitialized usb_anchor structure:
   8
   9 [  855.435820] ieee80211 phy3: rt2x00usb_vendor_request: Error - Vendor Request 0x07 failed for offset 0x1000 with error -19
  10 [  855.435826] ieee80211 phy3: rt2800_probe_rt: Error - Invalid RT chipset 0x0000, rev 0000 detected
  11 [  855.435829] ieee80211 phy3: rt2x00lib_probe_dev: Error - Failed to allocate device
  12 [  855.435845] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
  13 [  855.435900] IP: _raw_spin_lock_irq+0xd/0x30
  14 [  855.435926] PGD 0
  15 [  855.435953] Oops: 0002 [#1] SMP
  16 <snip>
  17 [  855.437011] Call Trace:
  18 [  855.437029]  ? usb_kill_anchored_urbs+0x27/0xc0
  19 [  855.437061]  rt2x00lib_remove_dev+0x190/0x1c0 [rt2x00lib]
  20 [  855.437097]  rt2x00lib_probe_dev+0x246/0x7a0 [rt2x00lib]
  21 [  855.437149]  ? ieee80211_roc_setup+0x9e/0xd0 [mac80211]
  22 [  855.437183]  ? __kmalloc+0x1af/0x1f0
  23 [  855.437207]  ? rt2x00usb_probe+0x13d/0xc50 [rt2x00usb]
  24 [  855.437240]  rt2x00usb_probe+0x155/0xc50 [rt2x00usb]
  25 [  855.437273]  rt2800usb_probe+0x15/0x20 [rt2800usb]
  26 [  855.437304]  usb_probe_interface+0x159/0x2d0
  27 [  855.437333]  driver_probe_device+0x2bb/0x460
  28
  29 Patch changes initialization sequence to fix the problem.
  30
  31 Cc: Vishal Thanki <vishalthanki@gmail.com>
  32 Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB")
  33 Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
  34 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  35 ---
  36  drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 13 ++++++++-----
  37  1 file changed, 8 insertions(+), 5 deletions(-)
  38
  39 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
  40 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
  41 @@ -825,10 +825,6 @@ int rt2x00usb_probe(struct usb_interface
  42         if (retval)
  43                 goto exit_free_device;
  44
  45 -       retval = rt2x00lib_probe_dev(rt2x00dev);
  46 -       if (retval)
  47 -               goto exit_free_reg;
  48 -
  49         rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,
  50                                         sizeof(struct usb_anchor),
  51                                         GFP_KERNEL);
  52 @@ -836,10 +832,17 @@ int rt2x00usb_probe(struct usb_interface
  53                 retval = -ENOMEM;
  54                 goto exit_free_reg;
  55         }
  56 -
  57         init_usb_anchor(rt2x00dev->anchor);
  58 +
  59 +       retval = rt2x00lib_probe_dev(rt2x00dev);
  60 +       if (retval)
  61 +               goto exit_free_anchor;
  62 +
  63         return 0;
  64
  65 +exit_free_anchor:
  66 +       usb_kill_anchored_urbs(rt2x00dev->anchor);
  67 +
  68  exit_free_reg:
  69         rt2x00usb_free_reg(rt2x00dev);
  70