[netmojo]

This series closes four races in brcmfmac teardown and attach that can crash the kernel or use freed memory. They happen when brcmf_detach() runs while other code still uses what it frees (on a bus reset after a firmware crash, on unbind, and on modprobe -r), and when the IRQ thread reaches the protocol layer before brcmf_attach() has created it.

Changes

1. pcie: quiesce the IRQ thread before reset detaches.
   • Race: brcmf_pcie_reset() detaches with the PCIe state still UP, so a running handler can queue a firmware event while fweh is freed, then unmask the interrupt.
   • Fix: reset now does what remove does: set the state DOWN, mask, synchronize the IRQ, and mask again.
2. Keep fweh until P2P creators are done with it.
   • Race: a P2P_DEVICE create waits for IF_ADD under the wiphy lock, then writes to drvr->fweh. A reset that frees fweh without that lock leaves a timed-out create writing to freed memory.
   • Fix: brcmf_fweh_detach() is split, so fweh is freed only after the interfaces are gone and detach has cycled the wiphy lock. P2P creation also refuses to start once the bus is down, and looks up the primary interface only after that check.
3. Close dynamic netdevs before detach unregisters them.
   • Race: detach reads iflist[i] and removes netdevs without RTNL or the wiphy lock, racing brcmf_p2p_del_vif(). Taking both locks would hang RTNL users: unregistering an UP netdev closes it, and cfg80211's NETDEV_GOING_DOWN handler takes the wiphy mutex again.
   • Fix: detach does what nl80211_del_interface() does: dev_close() under RTNL alone, then take the wiphy lock and unregister.
4. pcie: dispatch RX only once the protocol is attached.
   • Race: setup sets the state UP before brcmf_attach(), and the IRQ thread re-arms whenever the state is UP. Two MSIs before preinit reach brcmf_proto_msgbuf_rx_trigger() with no protocol layer. A state left UP across a reset opens the same path during firmware download.
   • Fix: RX and re-arming are gated on a flag that preinit publishes after protocol initialization. The bus stop op clears it, then masks, synchronizes the IRQ, and masks again, before detach frees the protocol layer.

The crash

Without commits 1 and 4, a debugfs reset (echo 1 > /sys/kernel/debug/ieee80211/phyN/reset) on a BCM4387 with an AWDL interface up oopses in the IRQ thread:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000078
pc : brcmf_proto_msgbuf_rx_trigger+0x24/0x144 [brcmfmac]
lr : brcmf_pcie_isr_thread+0x108/0x164 [brcmfmac]
genirq: exiting task "irq/140-brcmf_p" (175906) is an active IRQ thread (irq 140)
ieee80211 phy2: brcmf_attach: dongle is not responding: err=-5

The faulting load is drvr->proto->pd with drvr->proto NULL. The machine later hung at shutdown. Which window the MSI arrived in, and what shutdown waited for, are unknown. This was reproduced once.

Testing

Setup: MacBook Pro 16-inch (M1 Pro, j316s), BCM4387/7, firmware 20.96.31.0.8.7.148, linux-aurora 7.2.11.aurora16 (bed544b). Modules built out of tree with clang 23.1.4, W=1 and CONFIG_BRCMDBG; the only warning is Kbuild's compiler-mismatch notice, which the base build also has. Every build includes the console-read bound from #453.

Each run performs one operation with an AWDL interface up and an AirDrop window open, then checks the loaded module's build ID, reattach (a fresh firmware banner), no Oops, WARNING, BUG, lockdep, hung-task, FW failed to initialize or Dongle setup failed message, Wi-Fi reassociation, and a new window with awdl0 UP.

Build	debugfs reset	unbind/bind	modprobe -r
base	Oops (above); attach fails	not run	not run
base + commit 1	pass	not run	not run
base + commits 1–3	pass	pass	pass
base + series	pass	pass	pass

Each cell is a single run, so a pass shows only that the run recovered, not a failure rate.

What a pass doesn't show:

• IOMMU faults: teardown logged new apple-dart 581008000.iommu: translation fault lines, which the run checks don't look for:

  Build	reset	unbind	modprobe -r
  commits 1–3	2	1	5
  series	3	0	4

• Other messages: teardown logged brcmf_msgbuf_delete_flowring: timed out waiting for txstatus, and attach logged add iface p2p-dev-wlan0 type 10 failed: err=-52. The latter also appears when the unmodified in-tree module loads.

• AirDrop: reopening a window sometimes needed AWDL enable retries before frames were sent; after the full series' unbind it took three. Receive wasn't tested.

• One unexplained failure: an earlier run of commits 1–3, without the wifi: brcmfmac: pcie: stop reading the firmware console at a bad index #453 bound and before the P2P lookup move, failed with FW failed to initialize. It wasn't reproduced.

Not tested: BCM4378, BCM4388, SDIO and USB buses, legacy (non-MSI) interrupts, suspend and resume, and an injected P2P_DEVICE create timeout racing detach.

Not fixed here

These are inherited from the base driver and each has its own issue:

• brcmfmac: p2p: P2P_DEVICE create failure after IF_ADD frees a vif that is still published #450, P2P_DEVICE unwind after IF_ADD: if the p2p_dev iovar fails because the bus went down, the fail path frees the vif but leaves ifp->vif and bss_idx[DEVICE].vif pointing at it, and a later brcmf_p2p_ifp_removed() uses it.
• brcmfmac: p2p: brcmf_p2p_add_vif() can read the primary interface while detach removes it #451, primary-interface lookup: commit 2 narrows this window but doesn't close it, because detach removes the primary without locks after setting BUS_DOWN.
• brcmfmac: pcie: setup failure after a reset schedules another reset, then releases the driver #452, setup failure after a reset: brcmf_fw_crashed() schedules another reset, and device_release_driver() follows at once.