[PATCH wireless] wifi: iwlwifi: pcie: cancel the ME recheck work on probe failure

[PATCH wireless] wifi: iwlwifi: pcie: cancel the ME recheck work on probe failure

[Navon John Lukose]

iwl_pcie_check_me_status() schedules me_recheck_wk a second out when it
cannot decide whether CSME is present yet. iwl_pci_gen1_2_probe() calls it
before iwl_drv_start(), and if that fails the error path goes straight to
iwl_trans_pcie_free() without cancelling the work. The trans, and with it
the delayed_work and the trans_pcie the callback dereferences, is freed
while the timer is still armed.

iwl_pcie_gen1_2_remove() does cancel it, so only the probe error path is
affected. Cancel it there too.

The window is narrow: reaching the schedule needs both reads in
iwl_pcie_check_me_status() to fail, and iwl_pci_probe() already bails with
-EIO on an all-ones CSR_HW_REV before iwl_pci_gen1_2_probe() runs, so it
takes a device that answers config space and CSR_HW_REV but then fails
iwl_trans_grab_nic_access(). I found this by inspection rather than by
tripping over it, and I have no way to force that state on the hardware I
have.

Cc: stable@vger.kernel.org
Fixes: 41fff83fe6cd ("wifi: iwlwifi: pcie: check for WiAMT/CSME presence")
Signed-off-by: Navon John Lukose <navonjohnlukose@gmail.com>
---
 drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c
index 28b276c..a30854d 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c
@@ -4369,6 +4369,8 @@ int iwl_pci_gen1_2_probe(struct pci_dev *pdev,
 
 	if (IS_ERR(iwl_trans->drv)) {
 		ret = PTR_ERR(iwl_trans->drv);
+		/* iwl_pcie_check_me_status() may have armed this */
+		cancel_delayed_work_sync(&trans_pcie->me_recheck_wk);
 		goto out_free_trans;
 	}
 
-- 
2.55.0