[PATCH v1] wifi: brcmfmac: skip bus_reset cancel when the work was never initialized

[PATCH v1] wifi: brcmfmac: skip bus_reset cancel when the work was never initialized

[Vitor Soares]

From: Vitor Soares <vitor.soares@toradex.com>

When the firmware request fails, brcmf_pcie_setup() releases its own
driver, which runs brcmf_pcie_remove() -> brcmf_bus_cancel_reset_work().
At that point brcmf_alloc() has set bus_if->drvr, but brcmf_attach() has
not run, so drvr->bus_reset was never INIT_WORK()ed. cancel_work_sync()
on the zeroed work then trips WARN_ON(!work->func) in __flush_work():

  brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac43752-pcie.bin failed with error -2
  brcmfmac 0000:01:00.0: brcmf_pcie_setup: Dongle setup failed
  ieee80211 phy0: brcmf_fw_crashed: Firmware has halted or crashed
  WARNING: kernel/workqueue.c:4409 at __flush_work+0x318/0x338, CPU#0: kworker/0:1/10
  Workqueue: events request_firmware_work_func
  Call trace:
   __flush_work+0x318/0x338 (P)
   cancel_work_sync+0x6c/0x90
   brcmf_bus_cancel_reset_work+0x3c/0x54 [brcmfmac]
   brcmf_pcie_remove+0x5c/0x124 [brcmfmac]
   pci_device_remove+0x44/0xd8
   device_remove+0x4c/0x80
   device_release_driver_internal+0x1d0/0x22c
   device_release_driver+0x18/0x24
   brcmf_pcie_setup+0x58/0xc94 [brcmfmac]
   brcmf_fw_request_done+0x14c/0x198 [brcmfmac]
   request_firmware_work_func+0x5c/0xe8

brcmf_bus_schedule_reset() already gates on bus_reset.func for this
reason. Apply the same check on the cancel side.

Reproduced on a BCM43752 PCIe module with the firmware file absent.
With this change the same failure path completes without the warning.

Fixes: 43b25879f004 ("wifi: brcmfmac: drain bus_reset work on device removal")
Cc: stable@vger.kernel.org
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 92ec269f43b2..a3d662348711 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -1186,7 +1186,7 @@ void brcmf_bus_cancel_reset_work(struct brcmf_bus *bus_if)
 {
 	mutex_lock(&bus_if->bus_reset_lock);
 	bus_if->removing = true;
-	if (bus_if->drvr)
+	if (bus_if->drvr && bus_if->drvr->bus_reset.func)
 		cancel_work_sync(&bus_if->drvr->bus_reset);
 	mutex_unlock(&bus_if->bus_reset_lock);
 }
-- 
2.53.0