Kernel trace when plug-off the device

[skyer9]

when i plug-off the device, kernel error occurs.
and only after reboot, device is recognized.

uname -a
Linux XXXXXXX 5.4.0-124-generic #140-Ubuntu SMP Thu Aug 4 02:23:37 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

lsusb
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 35bc:0102 Realtek 802.11ax WLAN Adapter
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

model : tp-link TXE70UH

[  409.746315] WARNING: CPU: 0 PID: 229 at /home/skyer9/work/rtw8852cu/phl/phl_role.c:1782 rtw_phl_wifi_role_free+0x28/0x5c [8852cu]
[  409.746315] Modules linked in: 8852cu(OE) uas usb_storage binfmt_misc cfg80211 nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua intel_rapl_msr intel_rapl_common intel_telemetry_pltdrv intel_punit_ipc snd_sof_pci intel_telemetry_core intel_pmc_ipc snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda mei_hdcp snd_sof_intel_byt x86_pkg_temp_thermal snd_sof_intel_ipc intel_powerclamp coretemp snd_sof hackrf snd_sof_xtensa_dsp videobuf2_vmalloc snd_hda_ext_core videobuf2_memops snd_soc_acpi_intel_match snd_soc_acpi videobuf2_v4l2 kvm videobuf2_common snd_soc_core videodev snd_hda_codec_hdmi snd_compress snd_hda_codec_realtek ac97_bus snd_pcm_dmaengine snd_hda_codec_generic ledtrig_audio rapl wmi_bmof intel_cstate mc snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core intel_xhci_usb_role_switch roles snd_hwdep snd_pcm snd_timer mei_me snd mei soundcore mac_hid sch_fq_codel acpi_call(OE) msr ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 btrfs
[  409.746357]  zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear i915 i2c_algo_bit crct10dif_pclmul crc32_pclmul drm_kms_helper syscopyarea ghash_clmulni_intel sysfillrect aesni_intel crypto_simd sysimgblt fb_sys_fops drm lpc_ich cryptd r8169 glue_helper realtek i2c_i801 ahci libahci wmi pinctrl_broxton video pinctrl_intel
[  409.746383] CPU: 0 PID: 229 Comm: kworker/0:3 Tainted: G           OE     5.4.0-124-generic #140-Ubuntu
[  409.746384] Hardware name: iEi B590/B590, BIOS B590AR14 06/11/2021
[  409.746392] Workqueue: usb_hub_wq hub_event
[  409.746478] RIP: 0010:rtw_phl_wifi_role_free+0x28/0x5c [8852cu]
[  409.746481] Code: c9 c3 0f 1f 44 00 00 40 84 f6 74 01 c3 55 48 89 e5 41 54 53 48 89 fb 4c 8b a7 c8 12 00 00 4c 89 e6 e8 96 ff ff ff 85 c0 74 02 <0f> 0b 4c 89 e6 48 89 df e8 6e 16 00 00 85 c0 74 02 0f 0b 4c 89 e6
[  409.746482] RSP: 0018:ffffadae00203940 EFLAGS: 00010202
[  409.746484] RAX: 0000000000000001 RBX: ffffadae00ca9000 RCX: 0000000000000005
[  409.746485] RDX: 0000000000000001 RSI: 28033b40407abf4b RDI: 00000000000350e0
[  409.746486] RBP: ffffadae00203950 R08: ffffa0c377e350e0 R09: ffffa0c376c03340
[  409.746487] R10: ffffa0c377e1c848 R11: 0000000000000000 R12: ffffadae0026b000
[  409.746488] R13: 0000000000000001 R14: ffffadae00203a28 R15: ffffadae00203a28
[  409.746489] FS:  0000000000000000(0000) GS:ffffa0c377e00000(0000) knlGS:0000000000000000
[  409.746491] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  409.746492] CR2: 00007f920179f000 CR3: 000000020b00a000 CR4: 00000000003406f0
[  409.746493] Call Trace:
[  409.746575]  rtw_hw_iface_deinit+0x34/0x42 [8852cu]
[  409.746633]  netdev_close+0x84/0x13e [8852cu]
[  409.746636]  __dev_close_many+0xa5/0x120
[  409.746638]  dev_close_many+0x91/0x150
[  409.746641]  rollback_registered_many+0x139/0x520
[  409.746643]  unregister_netdevice_queue+0x94/0x120
[  409.746645]  unregister_netdev+0x1d/0x30
[  409.746702]  rtw_os_ndev_unregister+0x5a/0x74 [8852cu]
[  409.746759]  rtw_os_ndevs_unregister+0x27/0x32 [8852cu]
[  409.746818]  rtw_dev_remove+0x32/0x123 [8852cu]
[  409.746821]  usb_unbind_interface+0x8c/0x260
[  409.746825]  device_release_driver_internal+0xf4/0x1d0
[  409.746827]  device_release_driver+0x12/0x20
[  409.746829]  bus_remove_device+0xe1/0x150
[  409.746831]  device_del+0x165/0x370
[  409.746833]  ? usb_remove_ep_devs+0x1f/0x30
[  409.746836]  usb_disable_device+0x95/0x1c0
[  409.746837]  usb_disconnect+0xc0/0x270
[  409.746839]  hub_port_connect+0x83/0x890
[  409.746842]  port_event+0x4f7/0x770
[  409.746845]  ? __switch_to_asm+0x34/0x70
[  409.746847]  hub_event+0x157/0x3a0
[  409.746852]  process_one_work+0x1eb/0x3b0
[  409.746854]  worker_thread+0x4d/0x400
[  409.746856]  kthread+0x104/0x140
[  409.746858]  ? process_one_work+0x3b0/0x3b0
[  409.746860]  ? kthread_park+0x90/0x90
[  409.746861]  ret_from_fork+0x35/0x40

i found two other link.
lwfinger/rtl8852au#55
lwfinger/rtl8852au#43

different chipset, different model, different manufacturer.

[ntzb]

@skyer9 this is because of the hang that happens when this driver calls os functions like register_netdevice and register_netdev.
it is most visible when you do iw dev wlan0 del - you will see it hangs right away, and you'll have to reboot as well.

I've found that a valid workaround for lock issues caused by calling register_netdevice and unregister_netdevice is calling cfg80211_register_netdevice and cfg80211_unregister_netdevice instead:
ntzb@891e3db

unfortunately, in this case, when register_netdev or unregister_netdev is called (notice the different functions, netdev vs netdevice), it means that the rtnl lock is needed, and you can't use the cfg80211 functions.
see for example this part of the code:

rtw8852cu/os_dep/linux/os_intfs.c

Line 706 in d256c2a

unregister_netdev(netdev);

you can try, for example, taking the lock, before reaching that part, and then call the cfg80211 functions, but not sure if this will help.

[skyer9]

thank you for information.