)]}'
{
  "commit": "08a3f02fea636e97a7422d1512f76dacdb5b0887",
  "tree": "36919105e45a3f09f050a8040d19c12315fc405a",
  "parents": [
    "c96334f67061eb45cef1e54f73e1846d57615ad1"
  ],
  "author": {
    "name": "Michele Dionisio",
    "email": "michele.dionisio@gmail.com",
    "time": "Thu Sep 24 14:30:27 2026 +0200"
  },
  "committer": {
    "name": "Johannes Berg",
    "email": "johannes.berg@intel.com",
    "time": "Wed Oct 07 12:48:14 2026 +0200"
  },
  "message": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n   device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n   calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n   1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n   which unregisters the wdev and frees the vif and the ifp.\n\n - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,\n   and calls brcmf_remove_interface(ifp, false) for the same ifp.\n   brcmf_p2p_ifp_removed() reads ifp-\u003evif and then blocks on\n   rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls\n   cfg80211_unregister_wdev() on the wdev that was already unregistered\n   and freed.\n\nThe second list_del_rcu() of wdev-\u003elist faults on LIST_POISON2:\n\n  brcmfmac: brcmf_p2p_del_vif delete P2P vif\n  brcmfmac: brcmf_p2p_deinit_discovery enter\n  brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared\n  brcmfmac: brcmf_detach Enter\n  brcmfmac: brcmf_bus_change_state 1 -\u003e 0\n  brcmfmac: brcmf_remove_interface Enter, bsscfgidx\u003d1, ifidx\u003d0\n  brcmfmac: brcmf_del_if Enter, bsscfgidx\u003d1, ifidx\u003d0\n  brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n  [1.5 s later, brcmf_p2p_del_vif() timed out]\n  brcmfmac: brcmf_remove_interface Enter, bsscfgidx\u003d1, ifidx\u003d0\n  brcmfmac: brcmf_del_if Enter, bsscfgidx\u003d1, ifidx\u003d0\n  brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n  Unable to handle kernel paging request at virtual address dead000000000122\n  Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP\n  pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n  Call trace:\n   _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n   cfg80211_unregister_wdev+0x10/0x1c [cfg80211]\n   brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]\n   brcmf_remove_interface+0x1f4/0x254 [brcmfmac]\n   brcmf_detach+0x88/0x180 [brcmfmac]\n   brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]\n   brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]\n   brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]\n   sdio_bus_remove+0x38/0x144\n   device_release_driver_internal+0x1e8/0x2c0\n   device_release_driver+0x14/0x20\n   brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]\n   brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]\n   __exit_compat+0x18/0x418 [brcmfmac_cyw]\n   __arm64_sys_delete_module+0x1ac/0x244\n\nThe log was taken with debug\u003d0x406 on an i.MX 8M Plus board with a\nCYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of\nbrcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same\nin mainline.\n\nTo reproduce:\n\n  1. Start wpa_supplicant on wlan0 and let it associate. It creates the\n     P2P device (iw dev shows \"type P2P-device\").\n  2. Stop wpa_supplicant and remove the driver without waiting for\n     wpa_supplicant to exit:\n\n       kill $(pidof wpa_supplicant)\n       rmmod brcmfmac_cyw brcmfmac\n\nThe crash is reproducible on that board.\n\nFor the interface without a netdev (the P2P device), take RTNL and the\nwiphy mutex in brcmf_detach() before reading iflist, and remove it with\nlocked\u003dtrue. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the\nslot empty. If brcmf_detach() runs first, nl80211 does not find the wdev\nany more. The interfaces with a netdev are removed as before, because\nbrcmf_del_if() takes RTNL on its own for the primary interface.\n\nFixes: 9831bcb987df (\"brcmfmac: Deleting of p2p device is leaking memory.\")\nCc: stable@vger.kernel.org\nAssisted-by: claude-opus-5-5\nSigned-off-by: Michele Dionisio \u003cmichele.dionisio@gmail.com\u003e\nAcked-by: Arend van Spriel \u003carend.vanspriel@broadcom.com\u003e\nLink: https://patch.msgid.link/20260924123027.4122909-2-michele.dionisio@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d2ae679856067a54a8fe04cf2535768ff97b6704",
      "old_mode": 33188,
      "old_path": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c",
      "new_id": "92ec269f43b232cc0558539da1b21d87b43aa7b1",
      "new_mode": 33188,
      "new_path": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
    }
  ]
}