From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f43.google.com (mail-lf1-f43.google.com [209.85.167.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF7C13B42F0 for ; Mon, 17 Aug 2026 07:01:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786950095; cv=none; b=qmHBWOA3lguHYOfN5GxNGch3KUKIGM99wt+Ich3YmfpVwP0osv79xh+gI3qXgaKJhCW2p144b6a9vdPRsslbPT0mcxXIzrLGydqRg0JqId5QvbxPL0WI3X/FuKinS7/sX/2vIFT0LNIyQ/MKATahbo/e5/hGxVGD8IDfvAy83Mg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786950095; c=relaxed/simple; bh=6kWVZxkaJrP2alMq9sRei0KuXnZM3rimkkYv/KPNMvE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=uCzPQoxHFIU9d+SnIzRT48Fts7zpgZGgc/9BS1JShgyxkbJop1HQ1pH2KPmb1S/piGjt1Hh0l3sAcXSHyQ3fcHkU8lwtEd8ogzJlFjFifyvskGpsiD1ywTTr6W0BJxsZNlfucMx3CuAMtmyuU89tZvPCgi4yqu4BkypEkKk2McM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hRiygVua; arc=none smtp.client-ip=209.85.167.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hRiygVua" Received: by mail-lf1-f43.google.com with SMTP id 2adb3069b0e04-5aebe49b227so569001e87.2 for ; Mon, 17 Aug 2026 00:01:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786950091; x=1787554891; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=8nFik9rvis0EY9a3fH4rtoEYKyrkMbT6h34IIsACnTo=; b=hRiygVuaNNZpWHnxb2rx572ozj//Zv+wx09ny3d0S3fT+ag37gYAn8vBZbP8pAf4+p QXMZ1ZR5sRKDlOwJi41xT/jEyQdAEaL3t68iSyYF5dAbo6BMdYatPDbGCaE1HIGZ3CRp zADl2JhzBcU0Qiq9UMB1rZj/SmtN6uXBHH+SwcibvWYVu3MsRqXV3U9h1FDASlB0aUfS o6WGY6DXW/JuzDeX1vGC9VycoXhxKEslpA5Jio7bXxl7b0y55wHYUqvMQ6BJRzBUczXB bv6UxYXFakSPF0dz8PyuRjf25W/Y5B5E04psG8ajqk2aahHp+BYdmhAjcTdijBkD0cOt 3Swg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786950091; x=1787554891; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8nFik9rvis0EY9a3fH4rtoEYKyrkMbT6h34IIsACnTo=; b=aRjuV/zOjHWDUMm6lR5CI/N4zpl4TdIIxemgCMsvaWNF/7tXiTl/Rd+nUjITY7PsOU wCYLaWUtIhx3htt6wcR7wT2FeYCMNAOva/YlHsc8t5YRzeYBkHOYb2PVy842jt4B/2vJ Aq39Im6e3HZciJYMkRlMlb5W97rmAO3syTcLG6FCPeD/1v4AqYLSpsgqZJXwamB+socK rt4hMBBR8eTQirWvbdYhCA18f0gVKrrg/GPlnavZmV8zmAfxh9dAB0WHiEulWr666Kup gEQoBffhZWw5wx812HXaTiIG/sUusHr17v39Fo1dwxwQ+FCyynw2llu+Myw/7odM7OcV jtjA== X-Forwarded-Encrypted: i=1; AHgh+RqR/Zl2pSpELnEofoaOeDIbMpm4kElyvE1dTdoDoCWkzKZdBKdB7h8hpY5E5L56lRYnk8bufrBpMwr5ia8=@vger.kernel.org X-Gm-Message-State: AOJu0Yzgy29a5XCm7HGWnLPZFjpWfeBSAO/SnQEpkJmepcwhJSCRAe3E wo3Z7Lx07MNHnmaG9Cc1haiUhGM6VY1XvF5E6nyGM2jjka4E5P7JCUjI X-Gm-Gg: AR+sD12X3z+TR1jbySIOr+ptgT+pKUCCfy6kt0DtNmmV38tYB2XcS9XGjshjHf7eFoV EZPXTOvrlce+ZXoL2fHDqQ3oD9gJI7L41dY8MuxLMGInnyBXMd7VML9mxe5UiZQYzdu3jn4MCgQ kzeMdcZ3ZtrVGck1BRrxQs3mg3ixEwvLQEhdEiTpWsrtt9pDy8BFjKFKKJmdxa9QRse4a9dcKXv 9jMVx0/nWLDYru0JLJzaHe9X0YpYBWIl+WqI0tAEW6tm54IjzcNWk1hNED7WiWKuZUJ+mG7J9JW u4myA6v0Srej61WxHHFwtiGkIWC77sU+Rdk8UM9kbV8cbksqfO6x7ZIqOZKgu87PadcSdsFhoFh V2MQCB+3UngUthagYlSy0lhS6ivt+WE/NnVmQcoeQsX7RLP0pX9R0Or5Ez9+2Jqx6TKYNxcYBaH 6RFHFbxvlywmTRLgDQoLjv30LFaWgb6d4Ts8oaMlMJpYEMV9n/hmkJLpIH4msOroQBv4JsakMX7 DU= X-Received: by 2002:a05:6512:63d2:10b0:5b4:59a3:c67 with SMTP id 2adb3069b0e04-5b459a30ec9mr1732291e87.3.1786950089145; Mon, 17 Aug 2026 00:01:29 -0700 (PDT) Received: from localhost.localdomain ([78.40.184.2]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5b46cfa87f8sm141201e87.33.2026.08.17.00.01.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Aug 2026 00:01:27 -0700 (PDT) From: Dmitriy Okunev To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , Sasha Levin , lvc-project@linuxtesting.org, Arend van Spriel , Johannes Berg , Marek Szyprowski , Runyu Xiao , Kees Cook , Fan Wu , Gokul Sivakumar , Daniel Kim , Franky Lin , Kalle Valo , Hante Meuleman , linux-wireless@vger.kernel.org, brcm80211@lists.linux.dev, brcm80211-dev-list.pdl@broadcom.com, linux-kernel@vger.kernel.org Subject: [PATCH 5.10/5.15/6.1] wifi: brcmfmac: initialize SDIO data work before cleanup Date: Mon, 17 Aug 2026 10:01:12 +0300 Message-ID: <20260817070112.4828-1-dokunevdmitriy@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Runyu Xiao commit 2a665946e0407a05a3f81bd56a08553c446498e0 upstream. brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls brcmf_sdio_remove(). brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the work item before the first failure path that can reach brcmf_sdio_remove(), so the cleanup path always observes a valid work object. This issue was found by our static analysis tool and then confirmed by manual review of the probe error path and the remove-time work drain. The problem pattern is an early setup failure that reaches a cleanup helper which cancels an embedded work item before its initializer has run. A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in the stack. Fixes: 9982464379e8 ("brcmfmac: make sdio suspend wait for threads to freeze") Signed-off-by: Runyu Xiao Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260619064401.1048976-1-runyu.xiao@seu.edu.cn Signed-off-by: Johannes Berg Signed-off-by: Dmitriy Okunev --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c index 6ac2132c3064..5338d93e5b22 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c @@ -4438,6 +4438,7 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) bus->sdiodev = sdiodev; sdiodev->bus = bus; skb_queue_head_init(&bus->glom); + INIT_WORK(&bus->datawork, brcmf_sdio_dataworker); bus->txbound = BRCMF_TXBOUND; bus->rxbound = BRCMF_RXBOUND; bus->txminmax = BRCMF_TXMINMAX; @@ -4451,7 +4452,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) goto fail; } brcmf_sdiod_freezer_count(sdiodev); - INIT_WORK(&bus->datawork, brcmf_sdio_dataworker); bus->brcmf_wq = wq; /* attempt to attach to the dongle */ -- 2.53.0