[PATCH] wifi: rtw88: usb: stop RX work before unregistering hardware

[Zhao Li]

Disconnecting an rtw88 USB device while RX traffic is active can leave
the RX worker running after mac80211 hardware is unregistered. A firmware
event can then queue C2H work onto a destroyed workqueue.

rtw_usb_disconnect() kills active RX URBs and unregisters the hardware
without disabling rx_urb_work or canceling rx_work. The resubmission work
can restart a killed URB, while an in-flight RX worker can keep processing
packets during teardown.

Disable rx_urb_work before killing the active RX URBs, then cancel
rx_work synchronously before unregistering the hardware.

LLM assistance was used to find the bug and review.

Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
Fixes: 3e3aa566dd18 ("wifi: rtw88: usb: Preallocate and reuse the RX skbs")
Cc: stable@xxxxxxxxxxxxxxx # needs adjustments for <= 6.13
Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
---
Validation: A W=1 module build with MODPOST passed on the rtw
tree. Not reproduced; rtw88 USB hardware was unavailable.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.
Kernels before 6.14 have no rx_urb_work, and 6.6 also lacks
disable_work_sync(). There, killing the URBs already stops resubmission,
so the backport only needs cancel_work_sync(&rtwusb->rx_work) after
rtw_usb_cancel_rx_bufs().

 drivers/net/wireless/realtek/rtw88/usb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index 64e1c3420e0a..1d2759eb96bf 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -1370,7 +1370,10 @@ void rtw_usb_disconnect(struct usb_interface *intf)
 	rtwdev = hw->priv;
 	rtwusb = rtw_get_usb_priv(rtwdev);
 
+	/* Stop deferred resubmission before killing the active RX URBs. */
+	disable_work_sync(&rtwusb->rx_urb_work);
 	rtw_usb_cancel_rx_bufs(rtwusb);
+	cancel_work_sync(&rtwusb->rx_work);
 
 	rtw_unregister_hw(rtwdev, hw);
 	rtw_usb_deinit_tx(rtwdev);

base-commit: af32da41b0327b9c6a37856ba82b6760d6c8d10e
-- 
2.56.0