[PATCH 2/4] wifi: brcmfmac: Fix brcmf_pno_detach NULL-pointer deference

From: Sean Anderson

Date: Mon Sep 21 2026 - 17:18:59 EST


brcmf_pno_attach is called when firmware is loaded, which may not have
happened yet at removal time. Skip the rest of the cleanup if pi is
NULL.

Fixes: efc2c1fa8e14 ("brcmfmac: add support multi-scheduled scan")
Signed-off-by: Sean Anderson <sanderson@xxxxxxxxx>
---

drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
index d9fc94076791d..07d195e4d2832 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
@@ -533,6 +533,8 @@ void brcmf_pno_detach(struct brcmf_cfg80211_info *cfg)
brcmf_dbg(TRACE, "enter\n");
pi = cfg->pno;
cfg->pno = NULL;
+ if (!pi)
+ return;

WARN_ON(pi->n_reqs);
mutex_destroy(&pi->req_lock);
--
2.53.0