Re: [PATCH v2] wifi: rtw88: usb: stop RX work before unregistering hardware

[Luka Gejak]

November 1, 2026 at 2:43 PM, "Zhao Li" <enderaoelyther@xxxxxxxxx> wrote:

> 
> Disconnecting an rtw88 USB device while RX traffic is active can leave
> the RX worker running after mac80211 hardware is unregistered. A firmware
> event can then queue C2H work onto a destroyed workqueue.
> 
> rtw_usb_disconnect() kills the RX URBs but does not cancel rx_work,
> which their completions may already have queued. rxwq is destroyed only
> after rtw_unregister_hw().
> 
> Cancel rx_work synchronously after killing the RX URBs. Only a
> successful RX completion queues rx_work, and no RX URB can be
> resubmitted at this point: rtw88 does not set soft_unbind, so the USB
> core disables the endpoints before it calls rtw_usb_disconnect().
> 
> LLM assistance was used to find the bug and review.
> 
> Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
> ---

Looking good to me.

Reviewed-by: Luka Gejak <luka.gejak@xxxxxxxxx>

Best regards,
Luka Gejak