From nobody Thu Sep 24 18:40:57 2026 Received: from mail-qk2-f13.google.com (mail-qk2-f13.google.com [74.125.230.205]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14E573E867A for ; Mon, 21 Sep 2026 21:18:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.230.205 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790025503; cv=none; b=s7hL6QZ6SORmTObmbJNpZAKyP6Qa/HKGEn78s7rBNwcN79d1P71PGzSE6UEEnP3AqJf0OevjnNfJFF/76OtcxE5kgfRLhK0PBQrv4VGQ6M0GYYXApJffx92C0UZOHuOxWjYJN3L+JguhZlxFqXoCiDqxnWDOCeAk8n6Gwef7Fl0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790025503; c=relaxed/simple; bh=72VPKGFgUFUjrL2n1VYKmbyNf3I0BnnQw/kQ9VbMmhc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PpcHDjGxnVx2JRVCfzctjo99MBvniuQ2roDiJAoIK7ylJWkZnbRYffeUR7bJpD98yCUi+6gaAHwOzo986qYeXafVFvzg8Hr/7G8efKVCGZZpd3/aQmaHvc7X3xzcPcQu6hSQYtH+gXR6iofODTRNPH81kb6B1WiLkUw3EIksq/k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=brivo.com; spf=pass smtp.mailfrom=brivo.com; dkim=pass (2048-bit key) header.d=brivo.com header.i=@brivo.com header.b=b7AceCuw; arc=none smtp.client-ip=74.125.230.205 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=brivo.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=brivo.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=brivo.com header.i=@brivo.com header.b="b7AceCuw" Received: by mail-qk2-f13.google.com with SMTP id d75a77b69052e-52fb7692a57so42677181cf.1 for ; Mon, 21 Sep 2026 14:18:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brivo.com; s=google; t=1790025501; x=1790630301; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3XC9Sb/ipf1691XqMArNePnNNYX36EhvRdBJwfuO0HU=; b=b7AceCuwA7VVTS0jeFvUnrNbSLYisFbfbvuSUGbWdTb/7wGuUTLQLRykIQpWy6g1Dr M+3vUS0gANDzKphd8nH5TjFtPfNOtjd38/1RncKgIk7UQ/ihmBbvvRor4PU8kpz2KLmk 2afskiBzuf6DpudC6ESqHhX4UJbCspAIcRtK3x9biSpViNo0ivIsH7awcEsYhV63ydrE je50DMo4WD/tSxZKRhqVwLY3qZ5/GBkByeuU7BnfoeI46MGjfkzwazRIRCmD8lR4lHDP hTPSH67FQ+l7HOtMyu4LL7dO6ZIUudL70vDJGgTow4cLNazSC9XhvQIqpNpe9FKbzHfl kQnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790025501; x=1790630301; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=3XC9Sb/ipf1691XqMArNePnNNYX36EhvRdBJwfuO0HU=; b=h9cWNBN1Z7Qpl2W7Gzgy+oCjRM6Jxa7LFMY9QkB7g3VW0WS8JNPlzIjA01YgOCMKOE wNYQZ/10102nLpJ2PVaIoyiywlszD6MEGoa5Rdkm0XFlszblNp40djLQ3HJHeRJXO6D9 bXU4EpRJLgDyT/efv1LCMUdpTsOhA+NPTGKHqXZytVMSpXja21+LnBbVGZxa8FF2MGhP NQjSU9HhpNKkmLMrfcHjnM7CT7a5QYMOa5lIjFfZdO6R9jmh9i2AMfHH5DCcFqLz7brJ W6tBxxKCVZbfZL3vcGIAnRB8a35r9Ew0tMk9Zoira2UE7vMEdjvLlnhzHQxzpzRDYYTw 7VWQ== X-Forwarded-Encrypted: i=1; AKwUvBz4otmberoc1OblAWAuvzvY9l0j2ho+9sQSZIndH2tTU9TXUEh8CMOKlJt+TVffnj/0ZAcXI8pfEOx8bm8=@vger.kernel.org X-Gm-Message-State: AFuF++nifNZQWJZ0obPFuRWtbk38mYTycDtktvcbYVN9JLwz6ck2Ku6v Up9X2XigguMAxnpj7eh2sV5eivrlr1D2m7bR4eBKNCGz5vKD3X/DeDFbVcCMYarFW0+u0xEHRvL fM3q3jsJJG2eMKCsxTUYMr3Bbt+rgt1lyDOvdorAra3xxTxJ343xGk/7Ji6g= X-Gm-Gg: AYBFou2LP7Ra4umQqArqqywyZz/eEAqlznMzWUZpv7oEPVCjza+0EkG3LOff0cE0XCc gsZVBEGFJkenyHmcnVgLha4Y36aFayGu6sUYBuGMQSwPLR2UCTCkGM/gSNmwRh3rlZVjKAZu2YG tLlaV8LkvUGIppleKDifrjRMDj92SWytxQRUbM2sCUnWQ0qULaK+nywjooIyGXiFRf/K3V6Ih13 1pxcZVxsU3RJJn5rYEL0ENBZUYggBErUfcFKPSSCUdBGYMzNZ+6GP8soSngZdrQW6KupTIgBBS/ F9u7hwDkxK+r2qvDGSgJzhFzMRUOw/M/OaPmnnIj7dlD6oBukOxDPungR2sLS+ZFr5KE3ENQRju FXVsWU9TgehQhTvgf1UswmOV7KKLxqMA9e8Pt7slVSEtOjBOVRGqaePW1FApFjqSzXXqphAEAY2 zJcEbWsU4P4Lt2okTIFrMgAGmxZ/7LpOy70jeOQjYXulw1zRPFrCLSSzuoYV1kKPo= X-Received: by 2002:a05:622a:449:b0:530:b2e4:d598 with SMTP id d75a77b69052e-532dd5508e3mr6762731cf.51.1790025500842; Mon, 21 Sep 2026 14:18:20 -0700 (PDT) Received: from strozzi ([66.193.28.125]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-532df63ab0dsm267121cf.26.2026.09.21.14.18.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 14:18:20 -0700 (PDT) From: Sean Anderson To: Arend van Spriel , linux-wireless@vger.kernel.org Cc: Johannes Berg , brcm80211@lists.linux.dev, linux-kernel@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com, Sean Anderson , Fan Wu Subject: [PATCH 1/4] wifi: brcmfmac: Fix canceling uninitialized datawork Date: Mon, 21 Sep 2026 17:18:11 -0400 Message-ID: <20260921211817.2432341-2-sanderson@brivo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921211817.2432341-1-sanderson@brivo.com> References: <20260921211817.2432341-1-sanderson@brivo.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" datawork is currently initialized in brcmf_attach, but bus_if->drvr is created before this in brcmf_alloc. Both of these functions are called on firmware load, which may race with device removal. If this happens, cancel_work_sync may be called on an uninitialized datawork. Fix this by always initializing datawork before we set bus_if->drvr, as this matches the condition in brcmf_bus_cancel_reset_work. Fixes: 43b25879f004c ("wifi: brcmfmac: drain bus_reset work on device remov= al") Signed-off-by: Sean Anderson --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/driv= ers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index dad6f4563d146..a3163120154dd 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -1298,8 +1298,6 @@ static int brcmf_bus_started(struct brcmf_pub *drvr, = struct cfg80211_ops *ops) #endif #endif /* CONFIG_INET */ =20 - INIT_WORK(&drvr->bus_reset, brcmf_core_bus_reset); - /* populate debugfs */ brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read); debugfs_create_file("reset", 0600, brcmf_debugfs_get_devdir(drvr), drvr, @@ -1349,6 +1347,7 @@ int brcmf_alloc(struct device *dev, struct brcmf_mp_d= evice *settings) drvr =3D wiphy_priv(wiphy); drvr->wiphy =3D wiphy; drvr->ops =3D ops; + INIT_WORK(&drvr->bus_reset, brcmf_core_bus_reset); drvr->bus_if =3D dev_get_drvdata(dev); drvr->bus_if->drvr =3D drvr; drvr->settings =3D settings; --=20 2.53.0 From nobody Thu Sep 24 18:40:57 2026 Received: from mail-qk2-f13.google.com (mail-qk2-f13.google.com [74.125.230.205]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D814501290 for ; Mon, 21 Sep 2026 21:18:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.230.205 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790025504; cv=none; b=CbENV/84/1dDIDugEnossO6JzarPX1lHE89GwCQ01Q9datAE4FHyI3yKejOZvlYczdVBmpWMcM1O4Bl+MSsE1BR0FhyY+Qk7VLNTPPT1LCYk0+uLN6EgfngJElnngANWhGN5/5mfz0vsPg+sS4eXr2IzT5eTYy40sdomUW4IqbM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790025504; c=relaxed/simple; bh=VRpXZvIUbinbYCp8XtmrFt27Dn7YUlcSLIPDdw8ygUU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uZwUUepMFUStGZduf1pNB9ZzL47/5sCQ6UMXUhtbXeYb6E+q4x4GlIZSDIoPxWzba3WB7GNS3rDNTXcUYS+rL18w9QSJaFEEG1KN4a6CSojElDe69LayQ+Pp03ced+AeZI+yTVKO7VT0sMwRyfBgMbK0nLax3/REZZ476u6GczY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=brivo.com; spf=pass smtp.mailfrom=brivo.com; dkim=pass (2048-bit key) header.d=brivo.com header.i=@brivo.com header.b=p5JXF1dm; arc=none smtp.client-ip=74.125.230.205 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=brivo.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=brivo.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=brivo.com header.i=@brivo.com header.b="p5JXF1dm" Received: by mail-qk2-f13.google.com with SMTP id d75a77b69052e-52fb76c9df1so41767661cf.3 for ; Mon, 21 Sep 2026 14:18:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brivo.com; s=google; t=1790025502; x=1790630302; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SnvuzFJ+dz4WWctMbBwhpqeLCGhBdru2A4mbwIW3v84=; b=p5JXF1dmRz3t9HsN+GGYB7YgxVeGocXigSKNl5uAcuU8DZDA/d5yGViKUNV9vdQsB9 akc9y29tGl+S1mr8ZP7IBxAWmxdCW9lDg14eWOyhwGP8kkwCZTZ3BPJ6WeVgAI0TRXPg /LAtySmr58SRKRP3MD5wjodCUT8Ya27bHHEC93BAqVybbnP4/JRHLn6R0Og39+BUV0CZ +4PAKxcClG+YwEetrj5Ts453pDMwjlvvi0BudESIHaurjsYxRlh9g/i+MEd+MvdJOfQ3 Z3uIAxB823KS4ylknvkqz5DB42475WODnE2MUz5rQoV7BwGq8mFwdLT1hOcmolno+/kA DwRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790025502; x=1790630302; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=SnvuzFJ+dz4WWctMbBwhpqeLCGhBdru2A4mbwIW3v84=; b=Fj/+JlysTOAKZ4olRoyAF5DwnPf7liLcbrkjtHuSvIm/SRUzkvsuR+MrxX1s1LwvUc bzzttNmfSYFOa9Y4jPRlrN5xB1qyF6jKDZw8KvM6sjZFjkr7zZtmt+sckaruKNMrl7bh WoJpckaz6U938ooGoGQ6lf4pEyktsrK9yecaICQKuvSzeqVgWE3CqN2LXdTnAAjat25Q QwnfFCd4Ycg5EZpcR0zUkTti1RktEDEPHsL0F1AA+8FpP+S2PXGkBRyLaFksSXSl7OmP WMdV01RD2ucEc9I9zx52btNzmfe7ZqGYGnC3X++BJh2CfReUsQCNmHpiHv01PriALgRi L1tA== X-Forwarded-Encrypted: i=1; AKwUvByUM74JebpNTn/X3tbx1jbfCRhESs2Ln/qnXzJa3BM46Bhbz23tBHcqKJDTwdz/nEipS2ixzczPmqI7g4o=@vger.kernel.org X-Gm-Message-State: AFuF++mfbjsQyX8LpM+09WjCT3sJlfp/3MI6sx+3iYepSewqZu91Yl2E bWyvhBm2UWSVYMjbu23iu9R0QNR5POj5wxYT+9g6H0ybae3FAhF/6xJ1YJDPMkrCiLPLWdkRblY UfoD1ozWij/Io46bwfW3Iknr9hEOQS9uyHAaQMeZuC4vEKT9j29QkjDHNu3Y= X-Gm-Gg: AYBFou3k0RbdMId1YQlf1D4Jbj0SS5jEUZWQwFIqJaCQkPfpzV3yzMcDRJDyi/7yp0M roOyQyx6Bke+u41/Gr9JODLJgbTZjq1LnP8rdvoFPjF0FBGD1kvfEoFnKeNL/iGseDTn1bogagd qo1vhWS9YfGDLffJXcz+rybiof7eNFtbJLIdJvuScON5fgReCaUyz1eAivJovuP5v4kpKfjIXIJ BxnQeKJqVEf7YNLSZSSyKmhgMRBZaxnX+WDzM/Na511mGbtSuccYk531+sZjUWd++gae8uDF0Ni BdjTfznKD7hReq4nXLsCCQLW2cuI8g6/NCAbp1TpRY6KTdZ5GixmpXmHrU2oXgupMHeXGi7yQqE HAuv/UsRXdT+64QGBbYzENdMkne/26mk8DzfzMVGqRVOxpiBJcllQfoKWlOcHKl496d6sn27Ik7 awV+QKckV4M+ag8WeFLUsgfIxKG+RWG4nAl2kRsT+Plu9NjEkc4Qf+FDaZ4/Z4aJTPc2kWgkbM/ UY= X-Received: by 2002:ac8:5e4f:0:b0:532:ca19:afc1 with SMTP id d75a77b69052e-532d8d8a849mr27485671cf.29.1790025501481; Mon, 21 Sep 2026 14:18:21 -0700 (PDT) Received: from strozzi ([66.193.28.125]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-532df63ab0dsm267121cf.26.2026.09.21.14.18.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 14:18:21 -0700 (PDT) From: Sean Anderson To: Arend van Spriel , linux-wireless@vger.kernel.org Cc: Johannes Berg , brcm80211@lists.linux.dev, linux-kernel@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com, Sean Anderson , Franky Lin Subject: [PATCH 2/4] wifi: brcmfmac: Fix brcmf_pno_detach NULL-pointer deference Date: Mon, 21 Sep 2026 17:18:12 -0400 Message-ID: <20260921211817.2432341-3-sanderson@brivo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921211817.2432341-1-sanderson@brivo.com> References: <20260921211817.2432341-1-sanderson@brivo.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" brcmf_pno_attach is called when firmware is loaded, which may not have happened yet at removal time. Skip the rest of the cleanup if pi is NULL. Fixes: efc2c1fa8e14 ("brcmfmac: add support multi-scheduled scan") Signed-off-by: Sean Anderson --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c b/drive= rs/net/wireless/broadcom/brcm80211/brcmfmac/pno.c index d9fc94076791d..07d195e4d2832 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c @@ -533,6 +533,8 @@ void brcmf_pno_detach(struct brcmf_cfg80211_info *cfg) brcmf_dbg(TRACE, "enter\n"); pi =3D cfg->pno; cfg->pno =3D NULL; + if (!pi) + return; =20 WARN_ON(pi->n_reqs); mutex_destroy(&pi->req_lock); --=20 2.53.0 From nobody Thu Sep 24 18:40:57 2026 Received: from mail-qk2-f12.google.com (mail-qk2-f12.google.com [74.125.230.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77F8331F986 for ; Mon, 21 Sep 2026 21:18:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.230.204 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790025505; cv=none; b=nrczmwY4wxh15Nl2gnL4kc+GMJJKls3M5yoVT0ecRwClZlr9APLXs38TFI7Uc6nAByKX1PwyuWkRFydXOAnPNuYSpFGTgSvTvIrhTHxiOofUt1LEhubN01KopIq1a7lWh063iCqtzVoqqoWXUTDqSad9utWVcv1iUAfbAYRhtkk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790025505; c=relaxed/simple; bh=lqlaVLAdW3RusXi9hr8ji68teprPCl9yDGSlYkQhc7E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=p/QREUHMFJdzbYuFB/y/YwvpOhJaLCwiHhqLxkC8PxhY5I4AMGD0hnGTepNQKnCx1WHka0YnFdpaz0jN5iD27DdkyPlYWWA+sEUAwoWlNhZiziYANh26OSYfjJxusRKZbQ9oJmGg9oKanlaC99aEG4qsidgbcYXuuP14cH9EWIc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=brivo.com; spf=pass smtp.mailfrom=brivo.com; dkim=pass (2048-bit key) header.d=brivo.com header.i=@brivo.com header.b=g1NDhf6d; arc=none smtp.client-ip=74.125.230.204 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=brivo.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=brivo.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=brivo.com header.i=@brivo.com header.b="g1NDhf6d" Received: by mail-qk2-f12.google.com with SMTP id d75a77b69052e-52fb76ec395so29167351cf.2 for ; Mon, 21 Sep 2026 14:18:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brivo.com; s=google; t=1790025502; x=1790630302; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=fy12LLLF40JV1TUAxtDh7xlRrhTU4s9UAumnOpBUKSE=; b=g1NDhf6dGT/rTB6MRGPoggkStgjruchPcoRn/WCwWcfWgY7REGSgBS1Xtgmu1mClww Tx+ia4tp1581hx5482HuUPVg01YidckG4lsBrgkDg7mdwZeWXVSWZFU0F6iRoxeXsVAh dRjGSY+m/c9G4RtAT6loabacmrogILZ+KkL+bUcOnuOwGKImFGQdWGOuDGS8X4thM6OE DDEkcVvFonDlKyoKx1KGVQKeBeQh4CHDNvkQ672zNWlh3VgvE2oJWuRlP7WM3dtoAfxv AUlHuDPKNI+CiGGUVbW2t5HcUfjfaxkL1AFXR88qr2X9qtacKEaHqSpWLWXnLRXYWRfr zHJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790025502; x=1790630302; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=fy12LLLF40JV1TUAxtDh7xlRrhTU4s9UAumnOpBUKSE=; b=hHFEFHs+Tq9C2ebmD5kF6BLevZHlmTVQFNQ7ydu/+lpDm8232OkuuqP25IMIB1EhDm v9W2/u4/RqFH9ulVXLsj3NcIetV+pEONR3uHdTllYeiqpyyBlUioxywH5smOVap/wr9m rf6n3jUo5MSLp+wNikJFJgMB45VcZeT/I4jxbPDnv/oy46m8A6wvnL4e9K+Yrxhq9ncO tR8Sooy2rUW8V+r7SzRUW3tkq/DTa1rStQ6hmNn/SGHLvB1QESGh4l9L0Nqy7ABHNvJC 0lGPH3YklsLQxiM8KgmF+9xN+N+sx660FGBcIK+NjUD2/OG5hcDfkEoZCdqG4wxa1QsQ 3uYg== X-Forwarded-Encrypted: i=1; AKwUvBxYZxavpPetarqubg1fS3gpJCyZCIaa6R1XM1wUwPUDssVGgNs1e0uP8+Xi92BPOXcRm+TeheolMzoMArA=@vger.kernel.org X-Gm-Message-State: AFuF++krtLMOY1dVVfqUFUCiIVsynhX/3hciDpKfhSlu+mXhMU3+sp51 zJMB3Lazza9Y7Ii94ANRbRVxrgUCve2MLUp9xypoQ3XoXetSW7m467aCx4CV5uezNLWXszN7c3U Z8C8IEtYXP8R5n2LvLibChGudTDfAMQIvEDFFnQGTU7hE34chzEovy0CmDdA= X-Gm-Gg: AYBFou0/0QlYpgzFjcCMeR8TEBQveXTzWD6daBMq7iSl6VB6g+9ryCsd1lihSeZ+wgX zczjTDsf5FefRvnljBD7FjohqKu3m3CJ1kAWEZnghDtl0XRuXP9mHlh97hvk8AQREPGdRkvWmQV mIkY+FDZyV2I9QA/d2dIQqzwroorRwbdUU3+5UHD5a+Z2K4+hVDs42DA26Nq+S9F7720DYOcYyd MV14eQsScFB4aWxpmpypF3b/N5BEKRXOX93mj3UOt22YJUnxBq73VYpNFOK+blJOemTwr21sQVc RXWRKzUnWKoeDDnvasSevncRewyUKjEm4Mtno1FibekAYSvx8DQGN1EqeYCfy7FnYimpvXb1CGy xtpl/R7wfvtAYqi3xrxg4l22NZbt0jQqSvKIUMV1jD2O4coXfhmH2MmiBhrY/gLn0A4FC/kuj/W C+j0srDY9uDzhI5MIDzBrd14lAC6yUXtE8/XD11u3+3YIZjPxEoPdw1axzUdcUMCI= X-Received: by 2002:a05:622a:120e:b0:530:f39f:bdd6 with SMTP id d75a77b69052e-532d8e654d5mr27042791cf.54.1790025502461; Mon, 21 Sep 2026 14:18:22 -0700 (PDT) Received: from strozzi ([66.193.28.125]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-532df63ab0dsm267121cf.26.2026.09.21.14.18.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 14:18:21 -0700 (PDT) From: Sean Anderson To: Arend van Spriel , linux-wireless@vger.kernel.org Cc: Johannes Berg , brcm80211@lists.linux.dev, linux-kernel@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com, Sean Anderson , =?UTF-8?q?C=C3=A1ssio=20Gabriel?= , Danilo Krummrich , Greg Kroah-Hartman , Luis Chamberlain , "Rafael J. Wysocki" , Takashi Iwai , driver-core@lists.linux.dev Subject: [PATCH 3/4] firmware_loader: Return status from request_firmware_nowait_cancel Date: Mon, 21 Sep 2026 17:18:13 -0400 Message-ID: <20260921211817.2432341-4-sanderson@brivo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921211817.2432341-1-sanderson@brivo.com> References: <20260921211817.2432341-1-sanderson@brivo.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" request_firmware_nowait_cancel only cancels the most-recent matching firmware request. If the callback creates additional requests then there can be multiple requests in-flight (the original request and the (pending) additional request). If we try to cancel the request at that point, the original request may still be running. Add a status return from request_firmware_nowait_cancel so we can tell if there may still be additional requests we need to cancel. Signed-off-by: Sean Anderson --- drivers/base/firmware_loader/main.c | 11 ++++++++--- include/linux/firmware.h | 2 +- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_lo= ader/main.c index 24213a0ea8317..ea475aa48a316 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -1290,11 +1290,15 @@ EXPORT_SYMBOL_GPL(firmware_request_nowait_nowarn); * Cancel a pending request_firmware_nowait() request for @device, @context * and @cont. If the associated work has already started, this function wa= its * until the callback has returned. If the callback has already completed,= this - * function does nothing. + * function does nothing. This function may need to be called multiple tim= es if + * the callback makes additional firmware requests. * * This function may sleep. + * + * Return: %true if a request was canceled, or %false if no requests match= ed + * @device and @context. */ -void request_firmware_nowait_cancel(struct device *device, void *context, +bool request_firmware_nowait_cancel(struct device *device, void *context, void (*cont)(const struct firmware *fw, void *context)) { @@ -1313,9 +1317,10 @@ void request_firmware_nowait_cancel(struct device *d= evice, void *context, spin_unlock_irq(&firmware_work_lock); =20 if (!fw_work) - return; + return false; cancel_work_sync(&fw_work->work); firmware_work_free(fw_work); + return true; } EXPORT_SYMBOL_GPL(request_firmware_nowait_cancel); =20 diff --git a/include/linux/firmware.h b/include/linux/firmware.h index 0fa3b027f02f1..46c34ad0067e7 100644 --- a/include/linux/firmware.h +++ b/include/linux/firmware.h @@ -110,7 +110,7 @@ int request_firmware_nowait( struct module *module, bool uevent, const char *name, struct device *device, gfp_t gfp, void *context, void (*cont)(const struct firmware *fw, void *context)); -void request_firmware_nowait_cancel(struct device *device, void *context, +bool request_firmware_nowait_cancel(struct device *device, void *context, void (*cont)(const struct firmware *fw, void *context)); int request_firmware_direct(const struct firmware **fw, const char *name, --=20 2.53.0 From nobody Thu Sep 24 18:40:57 2026 Received: from mail-qk2-f12.google.com (mail-qk2-f12.google.com [74.125.230.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1D63514777 for ; Mon, 21 Sep 2026 21:18:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.230.204 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790025507; cv=none; b=CkzE4IkROUTJLgdD8ojNSqfPnBhwxChIsbrIR737P68jec8omqLcIjOul+TAMccGzIvc3W2Fq/prdVQvqISBR3pXdSM84vN93zZhVPJ+JPeScDuByTh6mwi9TzPeYTuvl/g5JRzt1YWDJXDcwkGPnnnh/Zs8DlO7HdijMXc92dM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790025507; c=relaxed/simple; bh=Oun0DqHeCwMETcPaSb9KTb2AnAMwyMp483QiKREFRRM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=T9Ri24xKIVVa0zWcDQdEXHQS40SCaPPexmjsjsga2neaBkzWn4GmvlkXvy3ggyz9uSW7XvNGTvS7odeOf/a+t9qLXWi2T7EIHmgxMfwwqyRG/qLfgEIp5baoTUKlRAlW99tj1uV3s/Tfx5QkNmhn3ME41nAV484RYsgfEyp7J5c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=brivo.com; spf=pass smtp.mailfrom=brivo.com; dkim=pass (2048-bit key) header.d=brivo.com header.i=@brivo.com header.b=wZQIgc9K; arc=none smtp.client-ip=74.125.230.204 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=brivo.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=brivo.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=brivo.com header.i=@brivo.com header.b="wZQIgc9K" Received: by mail-qk2-f12.google.com with SMTP id d75a77b69052e-52fb769ca17so28484691cf.2 for ; Mon, 21 Sep 2026 14:18:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brivo.com; s=google; t=1790025503; x=1790630303; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DjId/0Cj6ytuS0j5VADmUPuYZXdk67Lnv48DskXuzJU=; b=wZQIgc9KzmhQpjkXcOgbgrdacaJZMqIkz6HxAJGaWo6iR2H2rL+cQBgKOhlWEgboWG tXAJpaiukpcAyMaYLnBRrkVBDpc0dSZ1WL5O2Tfdn4E9B4sZ27les9/R949NQ++Y1Z0I Ab6hib79/VasBsEQUuueRFVUqkx8lbhO5vh0WgondkgPDVe4GjsUJINb7uhzYu7JbJml QF3F6CYqAA6po6LwssoTLY04u5DFGRUZbPgzUdsYalCnswX8OXKgyn2F0iemy286Qz0y nkrJrNDgTAXApBFBzPGFjAJ2EhU31u+dzYLYwjnt+UKDmPLYYdAOSAdVaa28J1JNMOuF GLJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790025503; x=1790630303; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DjId/0Cj6ytuS0j5VADmUPuYZXdk67Lnv48DskXuzJU=; b=VG8nffd7hDFn6iiBpN7l6BYSQ8qCYzsypMwBPLHe64gqSq9dGVQKVWiKf3ECgzTdHe Hy8jlbNsARcaMlcqutfqwja7QZylzDi7rLSFeIvlOsKC4NOMcS9WLHEYaxnLA5HGBpH6 BuT43HRb6x9WyOlJbsUyy+FQ2x0USj2PTsUSWDf/aarI3C9bE1TbM9CBK+0JTyt42HQ3 rhJSZR2SmNvTZFcNDOo1Sfw9cgKS516iBOHDgoFtAsyXT7ouJHz/i+qKaIt0ACPrEaLT HFsIJ0GoVnwAUFQhvYFe5Bp4OHDGqkeTUJzw5stF2hP01HuodoOn/cBOGlc18IkaUA6K LbWA== X-Forwarded-Encrypted: i=1; AKwUvBwoctIbLAXP2gcbdSn53IPCaGfPFFPNIFNClIZmRGod2Y7T90y/lpM4h7+5iX3A0W3CvZMwoskeTgsYex0=@vger.kernel.org X-Gm-Message-State: AFuF++lGAoufDjG10FIiINrnFJafoVe57o8pF6qIxng04q7KEIuyROAn fmB74J+ObSEsAIsrv8sUiwCCVhiYsKSXdgbJM0h4m/AkoEPUSGGcYpUUzscQRIrG8AmAhVvwdfT ztzKsKaSAB8ewNLietplfL7ood2B+b+ZJPT9SJ0skiEh+ceohm8vsolHn7lU= X-Gm-Gg: AYBFou1xqQXLwhBbB4pOehepd8yON5wH+BjY1mjCayKO2TW66p/4cw6ZR72WzXbHBoR Pl8xIVy1UqaCcdvzksxP+ThdouTxrmLTVTatanO6bQjKcjxH1WhnUk5lfgx58S3jJS5pA/yQRLb vb3eaLRu0btQMFdoiMwYvyrVfWrNKcGd6Rk+kdJvH67utW4X7abnbpPEVuhT2x07Cw1EY8M7R6Y Sd9kSVIrkk5354C8SATICQrvMRqq1HPb3d2b5ZdqGyZFWAfYXSWXkNCciTgN4fZYD1kF2J87ppl 4A8lb1CqrKEj0HLmQhkqQ1vw48f8EIjhrnkDTGxBObddjUoKVZbLz8ScmQgUfok0YvyXcnhTXHT 24T2PXMHTwpZmYL9JZPkoeUh9KAzXU6BOs2OAh2iudiE2dY66YQoN92Zotaq+pHV3weMbNaH/O5 vdrMS+kYRNxYhMxahUrlq5wumuuHLjw30s6K32xVLNgZ3kXp7B7YIEi3PPh9D3Py7W X-Received: by 2002:ac8:5d15:0:b0:532:d5c5:8eae with SMTP id d75a77b69052e-532d8d47ff4mr26530271cf.27.1790025503159; Mon, 21 Sep 2026 14:18:23 -0700 (PDT) Received: from strozzi ([66.193.28.125]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-532df63ab0dsm267121cf.26.2026.09.21.14.18.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 14:18:22 -0700 (PDT) From: Sean Anderson To: Arend van Spriel , linux-wireless@vger.kernel.org Cc: Johannes Berg , brcm80211@lists.linux.dev, linux-kernel@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com, Sean Anderson , Franky Lin , "John W. Linville" Subject: [PATCH 4/4] wifi: brcmfmac: Fix firmware requests racing against SDIO removal Date: Mon, 21 Sep 2026 17:18:14 -0400 Message-ID: <20260921211817.2432341-5-sanderson@brivo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921211817.2432341-1-sanderson@brivo.com> References: <20260921211817.2432341-1-sanderson@brivo.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" brcmf_sdio_firmware_callback can race with device removal. If this happens it can re-register IRQs, dereference NULL pointers, and cause all sorts of havoc. Prevent this by canceling any outstanding firmware request as the first step of the removal process. When canceling the firmware request, we primarily need to ensure fwctx remains valid for all our calls to request_firmware_nowait_cancel. If we let it get free'd early then it could get re-used for some unrelated firmware request. To avoid this, we follow the same pattern that firmware_loader does. But while firmware_loader needs a spinlock, we can get away with a single pointer: - When ctxp is NULL, then we can't be canceled - When *ctxp =3D=3D fwctx, we're still alive - When *ctxp =3D=3D NULL, someone else has canceled the request (or we have run our natural course). - Whoever clears ctxp is responsible for freeing fwctx. There can be up to NR_CPUS requests in-flight at any given time, as each (alt) firmware request can create a new firmware request. Eventually, one of them will see that ctxp is cleared and stop spawning additional requests. If the firmware load fails while we are removing the device, we can no longer attempt to call device_release_driver. This will deadlock. We can't do this asynchronously either since we run the risk of releasing a totally different driver/device combo. We could techincally do this by dropping device_lock before waiting for the firmware to cancel, but that seems like a major headache (we would need to make ctxp a separate reference-counted allocation). I also implemented this fix for PCIe but I have only build-tested it. I didn't touch USB as it already uses a completion-based system to determine when it's OK to remove the driver. I didn't go with this approach because we could wait indefinitely for the firmware request to complete (such as if the firmware is on a slow device or loaded by userspace). Fixes: bd0e1b1d380e ("brcmfmac: use asynchronous firmware request in SDIO") Signed-off-by: Sean Anderson --- .../broadcom/brcm80211/brcmfmac/bcmsdh.c | 7 ++++- .../broadcom/brcm80211/brcmfmac/bus.h | 2 ++ .../broadcom/brcm80211/brcmfmac/firmware.c | 26 ++++++++++++++++--- .../broadcom/brcm80211/brcmfmac/firmware.h | 16 +++++++++++- .../broadcom/brcm80211/brcmfmac/pcie.c | 11 +++++--- .../broadcom/brcm80211/brcmfmac/sdio.c | 8 +++--- .../broadcom/brcm80211/brcmfmac/usb.c | 6 +++-- 7 files changed, 63 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/dr= ivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index 71c2f99cdb711..39916f5a699dd 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -1126,7 +1126,12 @@ static void brcmf_ops_sdio_remove(struct sdio_func *= func) if (bus_if) { sdiodev =3D bus_if->bus_priv.sdio; =20 - /* start by unregistering irqs */ + /* Cancel any outstanding firmware request, as it may try to + * call brcmf_sdiod_intr_register. + */ + brcmf_fw_cancel(sdiodev->dev, &bus_if->fwctx); + + /* Now we can unregister irqs */ brcmf_sdiod_intr_unregister(sdiodev); =20 if (func->num !=3D 1) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h b/drive= rs/net/wireless/broadcom/brcm80211/brcmfmac/bus.h index 9371c1489948c..81c17a8c235cc 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h @@ -157,6 +157,7 @@ struct brcmf_bus_stats { * @chip: device identifier of the dongle chip. * @chiprev: revision of the dongle chip. * @fwvid: firmware vendor-support identifier of the device. + * @fwctx: firmware request cancellation context * @always_use_fws_queue: bus wants use queue also when fwsignal is inacti= ve. * @wowl_supported: is wowl supported by bus driver. * @ops: callbacks for this bus instance. @@ -178,6 +179,7 @@ struct brcmf_bus { u32 chip; u32 chiprev; enum brcmf_fwvendor fwvid; + void *fwctx; bool always_use_fws_queue; bool wowl_supported; bool removing; /* device removal in progress; quiesce async work */ diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/= drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c index 22ff326f1924a..d1da65155e544 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c @@ -459,6 +459,7 @@ struct brcmf_fw { u32 curpos; unsigned int board_index; void (*done)(struct device *dev, int err, struct brcmf_fw_request *req); + void **ctxp; }; =20 #ifdef CONFIG_EFI @@ -693,7 +694,7 @@ static void brcmf_fw_request_done(const struct firmware= *fw, void *ctx) fwctx->req =3D NULL; } fwctx->done(fwctx->dev, ret, fwctx->req); - kfree(fwctx); + kfree(xchg(fwctx->ctxp, NULL)); } =20 static void brcmf_fw_request_done_alt_path(const struct firmware *fw, void= *ctx) @@ -703,7 +704,7 @@ static void brcmf_fw_request_done_alt_path(const struct= firmware *fw, void *ctx) const char *board_type, *alt_path; int ret =3D 0; =20 - if (fw) { + if (fw || !READ_ONCE(*fwctx->ctxp)) { brcmf_fw_request_done(fw, ctx); return; } @@ -755,7 +756,8 @@ static bool brcmf_fw_request_is_valid(struct brcmf_fw_r= equest *req) =20 int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *re= q, void (*fw_cb)(struct device *dev, int err, - struct brcmf_fw_request *req)) + struct brcmf_fw_request *req), + void **ctxp) { struct brcmf_fw_item *first =3D &req->items[0]; struct brcmf_fw *fwctx; @@ -776,6 +778,8 @@ int brcmf_fw_get_firmwares(struct device *dev, struct b= rcmf_fw_request *req, fwctx->dev =3D dev; fwctx->req =3D req; fwctx->done =3D fw_cb; + fwctx->ctxp =3D ctxp; + WRITE_ONCE(*ctxp, fwctx); =20 /* First try alternative board-specific path if any */ if (fwctx->req->board_types[0]) @@ -799,6 +803,22 @@ int brcmf_fw_get_firmwares(struct device *dev, struct = brcmf_fw_request *req, return 0; } =20 +void brcmf_fw_cancel(struct device *dev, void **ctxp) +{ + struct brcmf_fw *fwctx; + + fwctx =3D xchg(ctxp, NULL); + if (!fwctx) + return; + + /* Keep canceling requests until they see that we cleared ctxp */ + while (request_firmware_nowait_cancel(dev, fwctx, + brcmf_fw_request_done_alt_path)) + ; + request_firmware_nowait_cancel(dev, fwctx, brcmf_fw_request_done); + kfree(fwctx); +} + struct brcmf_fw_request * brcmf_fw_alloc_request(u32 chip, u32 chiprev, const struct brcmf_firmware_mapping mapping_table[], diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h b/= drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h index 4002d326fd21b..932899d4086b3 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h @@ -87,9 +87,23 @@ brcmf_fw_alloc_request(u32 chip, u32 chiprev, * Request firmware(s) asynchronously. When the asynchronous request * fails it will not use the callback, but call device_release_driver() * instead which will call the driver .remove() callback. + * + * ctxp is a (pointer to an) opaque pointer that may be passed to + * brcmf_fw_cancel(). */ int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *re= q, void (*fw_cb)(struct device *dev, int err, - struct brcmf_fw_request *req)); + struct brcmf_fw_request *req), + void **ctxp); + +/** + * brcmf_fw_cancel() - Cancel an outstanding firmware request + * @dev: Device requesting the firmware + * @ctxp: Opaque context pointer filled in by brcmf_fw_get_firmwares() + * + * Cancel an outstanding firmware request identified by @dev and @ctxp, wh= ich + * should be the same as passed to brcmf_fw_get_firmwares(). + */ +void brcmf_fw_cancel(struct device *dev, void **ctxp); =20 #endif /* BRCMFMAC_FIRMWARE_H */ diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/driv= ers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c index 55f4d7b970f28..9eae712b0d98c 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -1555,6 +1555,8 @@ static int brcmf_pcie_reset(struct device *dev) struct brcmf_fw_request *fwreq; int err; =20 + brcmf_fw_cancel(dev, &bus_if->fwctx); + brcmf_pcie_intr_disable(devinfo); =20 brcmf_pcie_bus_console_read(devinfo, true); @@ -1572,7 +1574,8 @@ static int brcmf_pcie_reset(struct device *dev) return -ENOMEM; } =20 - err =3D brcmf_fw_get_firmwares(dev, fwreq, brcmf_pcie_setup); + err =3D brcmf_fw_get_firmwares(dev, fwreq, brcmf_pcie_setup, + &bus_if->fwctx); if (err) { dev_err(dev, "Failed to prepare FW request\n"); kfree(fwreq); @@ -2231,7 +2234,6 @@ static void brcmf_pcie_setup(struct device *dev, int = ret, brcmf_err(bus, "Dongle setup failed\n"); brcmf_pcie_bus_console_read(devinfo, true); brcmf_fw_crashed(dev); - device_release_driver(dev); } =20 static struct brcmf_fw_request * @@ -2554,7 +2556,8 @@ brcmf_pcie_probe(struct pci_dev *pdev, const struct p= ci_device_id *id) goto fail_brcmf; } =20 - ret =3D brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup); + ret =3D brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup, + &bus->fwctx); if (ret < 0) { kfree(fwreq); goto fail_brcmf; @@ -2595,6 +2598,8 @@ brcmf_pcie_remove(struct pci_dev *pdev) brcmf_pcie_bus_console_read(devinfo, false); brcmf_pcie_fwcon_timer(devinfo, false); =20 + brcmf_fw_cancel(bus->dev, &bus->fwctx); + devinfo->state =3D BRCMFMAC_PCIE_STATE_DOWN; if (devinfo->ci) brcmf_pcie_intr_disable(devinfo); diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/driv= ers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c index 381801af3ac98..1c32fe5828a2f 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c @@ -4417,8 +4417,6 @@ static void brcmf_sdio_firmware_callback(struct devic= e *dev, int err, sdio_release_host(sdiod->func1); fail: brcmf_dbg(TRACE, "failed: dev=3D%s, err=3D%d\n", dev_name(dev), err); - device_release_driver(&sdiod->func2->dev); - device_release_driver(dev); } =20 static struct brcmf_fw_request * @@ -4546,7 +4544,8 @@ int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) } =20 ret =3D brcmf_fw_get_firmwares(sdiodev->dev, fwreq, - brcmf_sdio_firmware_callback); + brcmf_sdio_firmware_callback, + &sdiodev->bus_if->fwctx); if (ret !=3D 0) { brcmf_err("async firmware request failed: %d\n", ret); kfree(fwreq); @@ -4581,6 +4580,9 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus) bus->watchdog_tsk =3D NULL; } =20 + brcmf_fw_cancel(bus->sdiodev->dev, + &bus->sdiodev->bus_if->fwctx); + /* De-register interrupt handler */ brcmf_sdiod_intr_unregister(bus->sdiodev); =20 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drive= rs/net/wireless/broadcom/brcm80211/brcmfmac/usb.c index b41949a9bdc8e..e8c0db0c82689 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c @@ -1306,7 +1306,8 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_inf= o *devinfo, } =20 /* request firmware here */ - ret =3D brcmf_fw_get_firmwares(dev, fwreq, brcmf_usb_probe_phase2); + ret =3D brcmf_fw_get_firmwares(dev, fwreq, brcmf_usb_probe_phase2, + &bus->fwctx); if (ret) { brcmf_err("firmware request failed: %d\n", ret); kfree(fwreq); @@ -1524,7 +1525,8 @@ static int brcmf_usb_reset_resume(struct usb_interfac= e *intf) if (!fwreq) return -ENOMEM; =20 - ret =3D brcmf_fw_get_firmwares(&usb->dev, fwreq, brcmf_usb_probe_phase2); + ret =3D brcmf_fw_get_firmwares(&usb->dev, fwreq, brcmf_usb_probe_phase2, + &devinfo->bus_pub->bus->fwctx); if (ret < 0) kfree(fwreq); =20 --=20 2.53.0