[PATCH wireless] wifi: rsi: shut down roc_timer before freeing mac80211 hardware

[Tristan Madani]

rsi_mac80211_detach() calls ieee80211_free_hw() which destroys the
ieee80211_hw structure, but the ROC timer can still fire and call
ieee80211_remain_on_channel_expired() with the freed hw pointer.

Add timer_shutdown_sync() in rsi_mac80211_detach() before
ieee80211_stop_queues() so the timer cannot fire after the hardware
structure is freed. Also add a belt-and-suspenders shutdown in
rsi_91x_deinit() for the probe-error paths that call deinit directly
without going through rsi_mac80211_detach(). timer_shutdown_sync()
prevents the callback from rearming the timer.

Fixes: df771911914a ("rsi: add support for p2p listen")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
---
 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 3 +++
 drivers/net/wireless/rsi/rsi_91x_main.c     | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 3faf2235728be..90b0fb80d91f8 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -301,9 +301,12 @@ static void rsi_mac80211_cancel_hw_scan(struct ieee80211_hw *hw,
  */
 void rsi_mac80211_detach(struct rsi_hw *adapter)
 {
+	struct rsi_common *common = adapter->priv;
 	struct ieee80211_hw *hw = adapter->hw;
 	enum nl80211_band band;
 
+	timer_shutdown_sync(&common->roc_timer);
+
 	if (hw) {
 		ieee80211_stop_queues(hw);
 		ieee80211_unregister_hw(hw);
diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
index 2ce5147666208..e893bba868b72 100644
--- a/drivers/net/wireless/rsi/rsi_91x_main.c
+++ b/drivers/net/wireless/rsi/rsi_91x_main.c
@@ -419,7 +419,7 @@ void rsi_91x_deinit(struct rsi_hw *adapter)
 #endif
 
 	common->init_done = false;
-
+	timer_shutdown_sync(&common->roc_timer);
 	kfree(common);
 	kfree(adapter->rsi_dev);
 	kfree(adapter);
-- 
2.47.3