[PATCH 0/2] wifi: ipw2x00: drain IRQ tasklets during teardown

[PATCH 0/2] wifi: ipw2x00: drain IRQ tasklets during teardown

[Jiale Yao]

The ipw2100 and ipw2200 interrupt handlers defer device processing to
tasklets.  Their teardown paths free the IRQ, queues, MMIO mappings, and
driver-private state without draining tasklets that may already be queued.

Kill each IRQ tasklet after preventing new IRQ scheduling and before
releasing the resources used by the deferred handler.

Jiale Yao (2):
  wifi: ipw2100: drain IRQ tasklet during teardown
  wifi: ipw2200: drain IRQ tasklet during teardown

 drivers/net/wireless/intel/ipw2x00/ipw2100.c | 6 ++++--
 drivers/net/wireless/intel/ipw2x00/ipw2200.c | 5 ++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH 1/2] wifi: ipw2100: drain IRQ tasklet during teardown

[Jiale Yao]

The interrupt handler can queue irq_tasklet immediately before teardown
frees the IRQ.  free_irq() prevents new hard IRQ handlers, but it does
not drain a tasklet that was already queued.  The tasklet can therefore
access queues or MMIO after the remove and probe failure paths release
them.

Kill the tasklet after freeing the IRQ and before releasing resources it
can access.

Fixes: 2c86c275015c ("Add ipw2100 wireless driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/intel/ipw2x00/ipw2100.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
index 43b4e432956b..44c76f1789d2 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
@@ -6300,6 +6300,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
 
 		if (dev->irq)
 			free_irq(dev->irq, priv);
+		tasklet_kill(&priv->irq_tasklet);
 
 		ipw2100_kill_works(priv);
 
@@ -6346,6 +6347,9 @@ static void ipw2100_pci_remove_one(struct pci_dev *pci_dev)
 	 * FIXME: remove the comment above. */
 	unregister_netdev(dev);
 
+	free_irq(dev->irq, priv);
+	tasklet_kill(&priv->irq_tasklet);
+
 	ipw2100_kill_works(priv);
 
 	ipw2100_queues_free(priv);
@@ -6353,8 +6357,6 @@ static void ipw2100_pci_remove_one(struct pci_dev *pci_dev)
 	/* Free potential debugging firmware snapshot */
 	ipw2100_snapshot_free(priv);
 
-	free_irq(dev->irq, priv);
-
 	pci_iounmap(pci_dev, priv->ioaddr);
 
 	/* wiphy_unregister needs to be here, before free_libipw */
-- 
2.34.1

[PATCH 2/2] wifi: ipw2200: drain IRQ tasklet during teardown

[Jiale Yao]

The interrupt handler can queue irq_tasklet just before teardown frees
the IRQ.  free_irq() prevents further hard IRQ handlers, but a tasklet
that is already queued can still run while the remove and probe failure
paths release its queues, command log, MMIO mapping, and private data.

Kill the tasklet after freeing the IRQ and before releasing resources it
can access.

Fixes: 43f66a6ce8da ("Add ipw2200 wireless driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/intel/ipw2x00/ipw2200.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index 8249d493ee22..e8112ef3150e 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -11720,6 +11720,7 @@ static int ipw_pci_probe(struct pci_dev *pdev,
 	sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
       out_release_irq:
 	free_irq(pdev->irq, priv);
+	tasklet_kill(&priv->irq_tasklet);
       out_iounmap:
 	iounmap(priv->hw_base);
       out_pci_release_regions:
@@ -11751,6 +11752,9 @@ static void ipw_pci_remove(struct pci_dev *pdev)
 
 	unregister_netdev(priv->net_dev);
 
+	free_irq(pdev->irq, priv);
+	tasklet_kill(&priv->irq_tasklet);
+
 	if (priv->rxq) {
 		ipw_rx_queue_free(priv, priv->rxq);
 		priv->rxq = NULL;
@@ -11802,7 +11806,6 @@ static void ipw_pci_remove(struct pci_dev *pdev)
 	ipw_prom_free(priv);
 #endif
 
-	free_irq(pdev->irq, priv);
 	iounmap(priv->hw_base);
 	pci_release_regions(pdev);
 	pci_disable_device(pdev);
-- 
2.34.1