From 089ee0bf87229b2bc7e47bdaf10ad77efd424ca7 Mon Sep 17 00:00:00 2001 From: xuxinchun1003 Date: Wed, 7 Oct 2026 07:42:31 +0800 Subject: [PATCH] fix: NULL-guard bus teardown and clear drvdata after cleanup completes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review-driven rework of the teardown lifetime (shenmintao/aic8800d80#103): - aicwf_bus_deinit(): keep the entry NULL guard (sequential double-deinit on probe-failure paths), but move dev_set_drvdata(dev, NULL) to the END of completed cleanup — after URB cancel, platform/rx/cmd teardown and the kthread_stop() join of bustx_thread. The previous placement (right after bus_stop) opened a real race: aicwf_usb_bus_txdata() re-reads drvdata and runs from bustx_thread, which is joined only later, and the TX-path state check is not a synchronization point. With the new ordering every cleanup callback and TX reader observes a non-NULL pointer throughout. - aicwf_usb_bus_stop(): NULL-check bus_if before dereferencing bus_if->bus_priv.usb (defense in depth; historical host oops RIP aicwf_usb_bus_stop+0x11 on probe-failure rollback). Verification (isolated VFIO lab, one 2357:0147 unit, sustained ping -f): a test-only fault-injection build (not included) reaches the repeated-deinit path and prints "already deinitialized, skip" with BUG=0; missing-firmware init failure runs one clean deinit; physical unplug x8, sysfs unbind and authorized cold cycles, disconnect during scanning and during connection establishment, ifdown/up x5, rmmod/insmod x3 -> BUG=0 throughout (only the pre-existing WARNs at rwnx_main.c:1529 and rwnx_cfg80211_disconnect:3328). --- drivers/aic8800/aic8800_fdrv/aicwf_txrxif.c | 23 +++++++++++++++++++++ drivers/aic8800/aic8800_fdrv/aicwf_usb.c | 8 ++++++- 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/drivers/aic8800/aic8800_fdrv/aicwf_txrxif.c b/drivers/aic8800/aic8800_fdrv/aicwf_txrxif.c index b848421..c15dcf6 100644 --- a/drivers/aic8800/aic8800_fdrv/aicwf_txrxif.c +++ b/drivers/aic8800/aic8800_fdrv/aicwf_txrxif.c @@ -210,6 +210,15 @@ void aicwf_bus_deinit(struct device *dev) AICWFDBG(LOGINFO, "%s Enter\r\n", __func__); bus_if = dev_get_drvdata(dev); + /* 入口判空：本函数在探测失败路径上会被调用**两次** + * aicwf_bus_init() 的 `fail:` 先调一次，随后 aicwf_usb_probe() 的 + * `out_free_bus:` 再调一次（用局部 bus_if 做 kfree，不依赖 drvdata）。 + * 第二次进入时 drvdata 已在**上一次调用的末尾**被清空 → 必然命中本判空。 + * 若不清空，第二次会对已完整拆解的对象重复执行整套 teardown。 */ + if (!bus_if) { + AICWFDBG(LOGINFO, "%s: already deinitialized, skip\n", __func__); + return; + } aicwf_bus_stop(bus_if); #ifdef AICWF_USB_SUPPORT @@ -260,6 +269,20 @@ void aicwf_bus_deinit(struct device *dev) tasklet_kill(&usb->xmit_tasklet); #endif + /* 清空 drvdata：全部拆解完成之后、对象由调用方释放之前。 + * （评审 shenmintao/aic8800d80#103 指出的顺序问题：此前清空点位于 + * bus_stop 之后、URB/platform/rx/cmd 拆解与 TX 线程 join 之前。） + * 1) 顺序双 deinit：第二次调用靠上方入口判空在本行之后必然 skip； + * 2) 过早清空会伤害仍在运行的读者——TX 链 + * usb_bustx_thread → aicwf_bus_txdata(usbdev->bus_if) → + * ops->txdata = aicwf_usb_bus_txdata()（usb.c 在该处重读 + * dev_get_drvdata）仅靠 state 检查做 check-then-act、无锁， + * 且该线程直到上方 kthread_stop(bustx_thread) 才被 join—— + * 必须先 join 再清； + * 3) cmd/rx/platform 拆解与 rwnx_close() 等读者在本行之前全程 + * 看到非空 drvdata，行为与未打补丁树一致。 */ + dev_set_drvdata(dev, NULL); + AICWFDBG(LOGINFO, "%s Exit \n", __func__); } diff --git a/drivers/aic8800/aic8800_fdrv/aicwf_usb.c b/drivers/aic8800/aic8800_fdrv/aicwf_usb.c index c25171b..16000d7 100644 --- a/drivers/aic8800/aic8800_fdrv/aicwf_usb.c +++ b/drivers/aic8800/aic8800_fdrv/aicwf_usb.c @@ -1946,9 +1946,15 @@ void aicwf_usb_cancel_all_urbs(struct aic_usb_dev *usb_dev){ static void aicwf_usb_bus_stop(struct device *dev) { struct aicwf_bus *bus_if = dev_get_drvdata(dev); - struct aic_usb_dev *usb_dev = bus_if->bus_priv.usb; + struct aic_usb_dev *usb_dev; AICWFDBG(LOGINFO, "%s\r\n", __func__); + /* 正常时序下 aicwf_bus_init() 已 set_drvdata、且 aicwf_bus_deinit() + * 调到本函数时 drvdata 尚未清空（清空在 deinit 末尾），故此处应非空； + * 判空为纵深防御：覆盖 probe 早期失败（set_drvdata 之前）等异常来源。 */ + if (bus_if == NULL) + return; + usb_dev = bus_if->bus_priv.usb; if (usb_dev == NULL) return;