Skip to content

Conversation

@opsiff
Copy link
Member

@opsiff opsiff commented Jan 25, 2025

Commit:
wifi: rtlwifi: rtl8821ae: Fix media status report
wifi: rtlwifi: pci: wait for firmware loading before releasing memory
wifi: rtlwifi: fix memory leaks and invalid access at probe error path
wifi: rtlwifi: destroy workqueue at rtl_deinit_core
wifi: rtlwifi: remove unused check_buddy_priv

Summary by Sourcery

Sync rtlwifi bug fixes from mainline. This includes fixing media status reports, waiting for firmware loading before releasing memory, fixing memory leaks and invalid access at probe error path, destroying workqueue at rtl_deinit_core, and removing unused check_buddy_priv.

Bug Fixes:

  • Fixed media status report.
  • Fixed memory leaks and invalid access at probe error path.
  • Fixed an issue where memory was released before firmware loading was complete.

Enhancements:

  • Removed the unused check_buddy_priv function.
  • Workqueues are now destroyed during deinitialization.

Thadeu Lima de Souza Cascardo and others added 5 commits January 25, 2025 22:11
mainline inclusion
from mainline-v6.14-rc1
category: bugfix

Commit 2461c7d ("rtlwifi: Update header file") introduced a global
list of private data structures.

Later on, commit 26634c4 ("rtlwifi Modify existing bits to match
vendor version 2013.02.07") started adding the private data to that list at
probe time and added a hook, check_buddy_priv to find the private data from
a similar device.

However, that function was never used.

Besides, though there is a lock for that list, it is never used. And when
the probe fails, the private data is never removed from the list. This
would cause a second probe to access freed memory.

Remove the unused hook, structures and members, which will prevent the
potential race condition on the list and its corruption during a second
probe when probe fails.

Fixes: 26634c4 ("rtlwifi Modify existing bits to match vendor version 2013.02.07")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241206173713.3222187-2-cascardo@igalia.com
(cherry picked from commit 2fdac64)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion
from mainline-v6.14-rc1
category: bugfix

rtl_wq is allocated at rtl_init_core, so it makes more sense to destroy it
at rtl_deinit_core. In the case of USB, where _rtl_usb_init does not
require anything to be undone, that is fine. But for PCI, rtl_pci_init,
which is called after rtl_init_core, needs to deallocate data, but only if
it has been called.

That means that destroying the workqueue needs to be done whether
rtl_pci_init has been called or not. And since rtl_pci_deinit was doing it,
it has to be moved out of there.

It makes more sense to move it to rtl_deinit_core and have it done in both
cases, USB and PCI.

Since this is a requirement for a followup memory leak fix, mark this as
fixing such memory leak.

Fixes: 0c81733 ("rtl8192ce: Add new driver")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241206173713.3222187-3-cascardo@igalia.com
(cherry picked from commit d8ece6f)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion
from mainline-v6.14-rc1
category: bugfix

Deinitialize at reverse order when probe fails.

When init_sw_vars fails, rtl_deinit_core should not be called, specially
now that it destroys the rtl_wq workqueue.

And call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be
leaked.

Remove pci_set_drvdata call as it will already be cleaned up by the core
driver code and could lead to memory leaks too. cf. commit 8d45093
("wireless: rtlwifi: remove unnecessary pci_set_drvdata()") and
commit 3d86b93 ("rtlwifi: Fix PCI probe error path orphaned memory").

Fixes: 0c81733 ("rtl8192ce: Add new driver")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241206173713.3222187-4-cascardo@igalia.com
(cherry picked from commit e7ceefb)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion
from mainline-v6.14-rc1
category: bugfix

At probe error path, the firmware loading work may have already been
queued. In such a case, it will try to access memory allocated by the probe
function, which is about to be released. In such paths, wait for the
firmware worker to finish before releasing memory.

Fixes: 3d86b93 ("rtlwifi: Fix PCI probe error path orphaned memory")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241206173713.3222187-5-cascardo@igalia.com
(cherry picked from commit b59b86c)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion
from mainline-v6.14-rc1
category: bugfix

RTL8821AE is stuck transmitting at the lowest rate allowed by the rate
mask. This is because the firmware doesn't know the device is connected
to a network.

Fix the macros SET_H2CCMD_MSRRPT_PARM_OPMODE and
SET_H2CCMD_MSRRPT_PARM_MACID_IND to work on the first byte of __cmd,
not the second. Now the firmware is correctly notified when the device
is connected to a network and it activates the rate control.

Before (MCS3):

[  5]   0.00-1.00   sec  12.5 MBytes   105 Mbits/sec    0    339 KBytes
[  5]   1.00-2.00   sec  10.6 MBytes  89.1 Mbits/sec    0    339 KBytes
[  5]   2.00-3.00   sec  10.6 MBytes  89.1 Mbits/sec    0    386 KBytes
[  5]   3.00-4.00   sec  10.6 MBytes  89.1 Mbits/sec    0    386 KBytes
[  5]   4.00-5.00   sec  10.2 MBytes  86.0 Mbits/sec    0    427 KBytes

After (MCS9):

[  5]   0.00-1.00   sec  33.9 MBytes   284 Mbits/sec    0    771 KBytes
[  5]   1.00-2.00   sec  31.6 MBytes   265 Mbits/sec    0    865 KBytes
[  5]   2.00-3.00   sec  29.9 MBytes   251 Mbits/sec    0    963 KBytes
[  5]   3.00-4.00   sec  28.2 MBytes   237 Mbits/sec    0    963 KBytes
[  5]   4.00-5.00   sec  26.8 MBytes   224 Mbits/sec    0    963 KBytes

Fixes: 39f4071 ("rtlwifi: rtl88821ae: Remove usage of private bit manipulation macros")
Cc: stable@vger.kernel.org
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/754785b3-8a78-4554-b80d-de5f603b410b@gmail.com
(cherry picked from commit 66ef028)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
@sourcery-ai
Copy link

sourcery-ai bot commented Jan 25, 2025

Reviewer's Guide by Sourcery

This pull request backports several bug fixes from the mainline kernel related to the rtlwifi driver. These fixes address issues such as incorrect media status reporting, potential memory leaks, and improper resource management during driver initialization and deinitialization.

Sequence diagram for improved rtlwifi driver initialization and cleanup

sequenceDiagram
    participant Driver as RTL WiFi Driver
    participant Core as RTL Core
    participant FW as Firmware
    participant HW as Hardware

    Driver->>Core: rtl_pci_probe()
    Core->>HW: Initialize hardware
    Core->>FW: Load firmware
    Note over Core,FW: Now waits for firmware completion
    alt Initialization fails
        Core->>FW: Wait for firmware_loading_complete
        Core->>Core: Cleanup resources
        Core->>Core: Deinit core
    end

    Note over Driver: During shutdown
    Driver->>Core: rtl_deinit_core()
    Core->>Core: Stop C2H command launcher
    Core->>Core: Free scan list entries
    Core->>Core: Free ACK queue entries
    Core->>Core: Destroy work queue
Loading

Class diagram showing removed global variable structure

classDiagram
    class rtl_priv {
        -ieee80211_hw* hw
        -completion firmware_loading_complete
        -rtl_priv* buddy_priv
        -rtl_works works
        +deinit()
    }

    class rtl_works {
        -workqueue* rtl_wq
        +destroy()
    }

    note for rtl_priv "Removed global var and list management"
    rtl_priv -- rtl_works
Loading

State diagram for improved driver cleanup process

stateDiagram-v2
    [*] --> Running
    Running --> Stopping: rtl_pci_disconnect
    Stopping --> CleaningResources: Stop adapter
    CleaningResources --> WaitingFirmware: Wait completion
    WaitingFirmware --> DeinitCore: Firmware done
    DeinitCore --> DestroyWorkqueue: Clean resources
    DestroyWorkqueue --> [*]: Release memory
Loading

File-Level Changes

Change Details Files
Fix media status report.
  • Corrected bit manipulation for setting the operation mode and MAC ID indicator in the media status report command.
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.h
Wait for firmware loading before releasing memory.
  • Modified the error handling in the probe function to wait for firmware loading completion before deallocating resources.
  • This ensures that firmware loading is complete before resources are released during a probe failure.
drivers/net/wireless/realtek/rtlwifi/pci.c
Fix memory leaks and invalid access at probe error path.
  • Moved the deinitialization of software variables to occur after waiting for firmware loading completion.
  • This prevents potential memory leaks and invalid memory access during probe failures.
drivers/net/wireless/realtek/rtlwifi/pci.c
Destroy workqueue at rtl_deinit_core.
  • Moved the workqueue destruction from rtl_pci_deinit to rtl_deinit_core to ensure it is always destroyed.
  • Added a check to ensure the workqueue exists before attempting to destroy it in rtl_deinit_core and _rtl_usb_cleanup_rx.
  • Set the workqueue pointer to NULL after destroying it to prevent double frees.
drivers/net/wireless/realtek/rtlwifi/pci.c
drivers/net/wireless/realtek/rtlwifi/base.c
drivers/net/wireless/realtek/rtlwifi/usb.c
Remove unused check_buddy_priv function.
  • Removed the rtl_pci_check_buddy_priv function from pci.c and the corresponding declaration from wifi.h.
  • Removed the call to check_buddy_priv from the rtl_intf_ops structure.
drivers/net/wireless/realtek/rtlwifi/pci.c
drivers/net/wireless/realtek/rtlwifi/wifi.h
Remove global variable and list.
  • Removed the global variable rtl_global_var and its associated list and lock.
  • Removed the addition and deletion of the rtl_priv from the global list.
  • Removed the glb_var member from the rtl_priv structure.
drivers/net/wireless/realtek/rtlwifi/pci.c
drivers/net/wireless/realtek/rtlwifi/base.c
drivers/net/wireless/realtek/rtlwifi/wifi.h

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!
  • Generate a plan of action for an issue: Comment @sourcery-ai plan on
    an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @opsiff - I've reviewed your changes and they look great!

Here's what I looked at during the review
  • 🟢 General issues: all looks good
  • 🟢 Security: all looks good
  • 🟢 Testing: all looks good
  • 🟢 Complexity: all looks good
  • 🟢 Documentation: all looks good

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@deepin-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sourcery-ai[bot]
Once this PR has been reviewed and has the lgtm label, please ask for approval from opsiff. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@opsiff opsiff changed the title [Deepin-Kernel-SIG] [Backport] [linux 6.6-y] Sync some rtlwifi bugfix from mainline [Deepin-Kernel-SIG] [Upstream] [linux 6.6-y] Sync some rtlwifi bugfix from mainline Jan 25, 2025
@opsiff opsiff merged commit a202546 into deepin-community:linux-6.6.y Jan 26, 2025
4 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants