[PATCH v2 0/2] wifi: brcmfmac: fix bus_reset work lifetime and scratch-buffer DMA double-free

[Fan Wu]

This series fixes two narrow reset/remove teardown bugs: a use-after-free
where the bus_reset work can outlive drvr (freed on removal via
brcmf_free() -> wiphy_free()), and a DMA double-free in the PCIe
reset/remove teardown.

Patch 1/2 makes brcmf_pcie_release_scratchbuffers() safe to call again
after a prior release: it freed the scratch/ringupd DMA buffers without
clearing the pointers, so reset teardown followed by remove() could
double-free them.  Split out as its own fix so it can be reviewed and
backported independently.

Patch 2/2 drains the bus_reset work item on device removal.  A per-bus
mutex serializes arming against that drain
(brcmf_bus_cancel_reset_work() sets "removing" and cancels the work
under the lock, before any free), and brcmf_fw_crashed() is NULL-guarded
before it dereferences drvr.  The mutex is safe because every arming
producer runs in process context (the PCIe firmware-halt notification
runs in the threaded IRQ handler; the SDIO one in the data workqueue).

This series does not attempt to address the separate, pre-existing
lifetime of the asynchronous firmware completion started by the PCIe
reset path.  That callback needs its own lifetime/ownership protocol and
is being tracked separately.

---
Changes in v2:
 - Following the v1 discussion with Eddie Phillips and Arend van Spriel,
   retain the mutex approach.
 - Split the scratch-buffer DMA double-free into 1/2.
 - Add the NULL guard before the drvr dereferences in 2/2.
 - Rebased onto wl-next/main.

Link: https://lore.kernel.org/linux-wireless/20260709101635.103005-1-fanwu01@xxxxxxxxxx/

Fan Wu (2):
  wifi: brcmfmac: make release_scratchbuffers idempotent
  wifi: brcmfmac: drain bus_reset work on device removal

 .../broadcom/brcm80211/brcmfmac/bcmsdh.c      | 13 ++++++
 .../broadcom/brcm80211/brcmfmac/bus.h         |  6 +++
 .../broadcom/brcm80211/brcmfmac/core.c        | 46 +++++++++++++++++--
 .../broadcom/brcm80211/brcmfmac/pcie.c        | 14 ++++++-
 .../broadcom/brcm80211/brcmfmac/sdio.c        |  6 +++
 .../broadcom/brcm80211/brcmfmac/sdio.h        |  1 +
 .../broadcom/brcm80211/brcmfmac/usb.c         |  3 ++
 7 files changed, 83 insertions(+), 6 deletions(-)

--
2.34.1