From: Vitor Soares <ivitro@gmail.com>
To: Arend van Spriel <arend.vanspriel@broadcom.com>
Cc: Vitor Soares <vitor.soares@toradex.com>,
linux-wireless@vger.kernel.org, brcm80211@lists.linux.dev,
brcm80211-dev-list.pdl@broadcom.com,
linux-kernel@vger.kernel.org, Fan Wu <fanwu01@zju.edu.cn>,
stable@vger.kernel.org
Subject: [PATCH v1] wifi: brcmfmac: skip bus_reset cancel when the work was never initialized
Date: Tue, 20 Oct 2026 21:39:13 +0100 [thread overview]
Message-ID: <20261020203916.381637-2-ivitro@gmail.com> (raw)
From: Vitor Soares <vitor.soares@toradex.com>
When the firmware request fails, brcmf_pcie_setup() releases its own
driver, which runs brcmf_pcie_remove() -> brcmf_bus_cancel_reset_work().
At that point brcmf_alloc() has set bus_if->drvr, but brcmf_attach() has
not run, so drvr->bus_reset was never INIT_WORK()ed. cancel_work_sync()
on the zeroed work then trips WARN_ON(!work->func) in __flush_work():
brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac43752-pcie.bin failed with error -2
brcmfmac 0000:01:00.0: brcmf_pcie_setup: Dongle setup failed
ieee80211 phy0: brcmf_fw_crashed: Firmware has halted or crashed
WARNING: kernel/workqueue.c:4409 at __flush_work+0x318/0x338, CPU#0: kworker/0:1/10
Workqueue: events request_firmware_work_func
Call trace:
__flush_work+0x318/0x338 (P)
cancel_work_sync+0x6c/0x90
brcmf_bus_cancel_reset_work+0x3c/0x54 [brcmfmac]
brcmf_pcie_remove+0x5c/0x124 [brcmfmac]
pci_device_remove+0x44/0xd8
device_remove+0x4c/0x80
device_release_driver_internal+0x1d0/0x22c
device_release_driver+0x18/0x24
brcmf_pcie_setup+0x58/0xc94 [brcmfmac]
brcmf_fw_request_done+0x14c/0x198 [brcmfmac]
request_firmware_work_func+0x5c/0xe8
brcmf_bus_schedule_reset() already gates on bus_reset.func for this
reason. Apply the same check on the cancel side.
Reproduced on a BCM43752 PCIe module with the firmware file absent.
With this change the same failure path completes without the warning.
Fixes: 43b25879f004 ("wifi: brcmfmac: drain bus_reset work on device removal")
Cc: stable@vger.kernel.org
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 92ec269f43b2..a3d662348711 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -1186,7 +1186,7 @@ void brcmf_bus_cancel_reset_work(struct brcmf_bus *bus_if)
{
mutex_lock(&bus_if->bus_reset_lock);
bus_if->removing = true;
- if (bus_if->drvr)
+ if (bus_if->drvr && bus_if->drvr->bus_reset.func)
cancel_work_sync(&bus_if->drvr->bus_reset);
mutex_unlock(&bus_if->bus_reset_lock);
}
--
2.53.0
reply other threads:[~2026-10-20 20:39 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020203916.381637-2-ivitro@gmail.com \
--to=ivitro@gmail.com \
--cc=arend.vanspriel@broadcom.com \
--cc=brcm80211-dev-list.pdl@broadcom.com \
--cc=brcm80211@lists.linux.dev \
--cc=fanwu01@zju.edu.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vitor.soares@toradex.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®