rt2x00usb: Use usb anchor to manage URB

With current driver, it is observed that a URB is not
completed while the USB disconnect is initiated. Due to
that, the URB completion handler is trying to access
the resource which was freed as a part of USB disconnect.
Managing the URBs with anchor will make sure that all
the URBs are handled gracefully before device gets
disconnected.

Signed-off-by: Vishal Thanki <vishalthanki@gmail.com>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00.h b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
index 6418620f95ff62a7e1a562b7cb29d6e306d2d4ad..3dacede7da5ec99fe1391bad5570a7e68dc61119 100644 (file)
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
@@ -38,6 +38,7 @@
 #include <linux/kfifo.h>
 #include <linux/hrtimer.h>
 #include <linux/average.h>
+#include <linux/usb.h>
 
 #include <net/mac80211.h>
 
@@ -1002,6 +1003,8 @@ struct rt2x00_dev {
 
        /* Extra TX headroom required for alignment purposes. */
        unsigned int extra_tx_headroom;
+
+       struct usb_anchor *anchor;
 };
 
 struct rt2x00_bar_list_entry {

diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
index 5639ed816813b21d886fe4e6011af7677e9b1aca..b2f7c586045d24ac0aa29bad9c79d9b0ac1f3666 100644 (file)
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
@@ -1422,11 +1422,14 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
        cancel_work_sync(&rt2x00dev->intf_work);
        cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
        cancel_work_sync(&rt2x00dev->sleep_work);
+#ifdef CONFIG_RT2X00_LIB_USB
        if (rt2x00_is_usb(rt2x00dev)) {
+               usb_kill_anchored_urbs(rt2x00dev->anchor);
                hrtimer_cancel(&rt2x00dev->txstatus_timer);
                cancel_work_sync(&rt2x00dev->rxdone_work);
                cancel_work_sync(&rt2x00dev->txdone_work);
        }
+#endif
        if (rt2x00dev->workqueue)
                destroy_workqueue(rt2x00dev->workqueue);
 

diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
index 7627af6098eb5896420ef99bbfcc5c022f116d39..7cf26c6124d12e8246de910cab351ca902a945ea 100644 (file)
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
@@ -171,8 +171,11 @@ static void rt2x00usb_register_read_async_cb(struct urb *urb)
 {
        struct rt2x00_async_read_data *rd = urb->context;
        if (rd->callback(rd->rt2x00dev, urb->status, le32_to_cpu(rd->reg))) {
-               if (usb_submit_urb(urb, GFP_ATOMIC) < 0)
+               usb_anchor_urb(urb, rd->rt2x00dev->anchor);
+               if (usb_submit_urb(urb, GFP_ATOMIC) < 0) {
+                       usb_unanchor_urb(urb);
                        kfree(rd);
+               }
        } else
                kfree(rd);
 }
@@ -206,8 +209,11 @@ void rt2x00usb_register_read_async(struct rt2x00_dev *rt2x00dev,
        usb_fill_control_urb(urb, usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                             (unsigned char *)(&rd->cr), &rd->reg, sizeof(rd->reg),
                             rt2x00usb_register_read_async_cb, rd);
-       if (usb_submit_urb(urb, GFP_ATOMIC) < 0)
+       usb_anchor_urb(urb, rt2x00dev->anchor);
+       if (usb_submit_urb(urb, GFP_ATOMIC) < 0) {
+               usb_unanchor_urb(urb);
                kfree(rd);
+       }
        usb_free_urb(urb);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_register_read_async);
@@ -313,8 +319,10 @@ static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry, void *data)
                          entry->skb->data, length,
                          rt2x00usb_interrupt_txdone, entry);
 
+       usb_anchor_urb(entry_priv->urb, rt2x00dev->anchor);
        status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
        if (status) {
+               usb_unanchor_urb(entry_priv->urb);
                if (status == -ENODEV)
                        clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
                set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
@@ -402,8 +410,10 @@ static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry, void *data)
                          entry->skb->data, entry->skb->len,
                          rt2x00usb_interrupt_rxdone, entry);
 
+       usb_anchor_urb(entry_priv->urb, rt2x00dev->anchor);
        status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
        if (status) {
+               usb_unanchor_urb(entry_priv->urb);
                if (status == -ENODEV)
                        clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
                set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
@@ -818,6 +828,13 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
        if (retval)
                goto exit_free_reg;
 
+       rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,
+                                       sizeof(struct usb_anchor),
+                                       GFP_KERNEL);
+       if (!rt2x00dev->anchor)
+               goto exit_free_reg;
+
+       init_usb_anchor(rt2x00dev->anchor);
        return 0;
 
 exit_free_reg: