RSS Bot Posted August 25, 2023 Share Posted August 25, 2023 After rtw_usb_alloc_rx_bufs() has been called rx urbs have been allocated and must be freed in the error path. After rtw_usb_init_rx() has been called they are submitted, so they also must be killed. Add these forgotten steps to the probe error path. Besides the lost memory this also fixes a problem when the driver fails to download the firmware in rtw_chip_info_setup(). In this case it can happen that the completion of the rx urbs handler runs at a time when we already freed our data structures resulting in a kernel crash. This has been applied to wireless-next https://lore.kernel.org/linux-wireless/8b4b4228bfd140119665417137a087ea@realtek.com/T/#t [ ] My code follows the style guidelines of this project [ ] I have performed a self-review of my own code [ ] I have commented my code, particularly in hard-to-understand areas [ ] I have made corresponding changes to the documentation [X] My changes generate no new warnings [ ] Any dependent changes have been merged and published in downstream modules View the full article Link to comment Share on other sites More sharing options...
Recommended Posts