[PATCH v2] wifi: rtw88: usb: stop RX work before unregistering hardware

[PATCH v2] wifi: rtw88: usb: stop RX work before unregistering hardware

[Zhao Li]

Disconnecting an rtw88 USB device while RX traffic is active can leave
the RX worker running after mac80211 hardware is unregistered. A firmware
event can then queue C2H work onto a destroyed workqueue.

rtw_usb_disconnect() kills the RX URBs but does not cancel rx_work,
which their completions may already have queued. rxwq is destroyed only
after rtw_unregister_hw().

Cancel rx_work synchronously after killing the RX URBs. Only a
successful RX completion queues rx_work, and no RX URB can be
resubmitted at this point: rtw88 does not set soft_unbind, so the USB
core disables the endpoints before it calls rtw_usb_disconnect().

LLM assistance was used to find the bug and review.

Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
Changes in v2:
- Drop disable_work_sync(&rtwusb->rx_urb_work): the endpoints are
  already disabled, so rx_urb_work cannot restart a killed URB (Luka)
- Correct the commit message accordingly
- Drop the 3e3aa566dd18 Fixes tag and the stable backport note; the
  patch now applies unchanged to 6.6.y and later

v1: https://lore.kernel.org/r/20261028141904.8707-1-enderaoelyther@gmail.com

Validation: A W=1 build of usb.o passed. Not reproduced; rtw88 USB
hardware was unavailable.
Sparse C=2 and Smatch introduced no new diagnostics.

 drivers/net/wireless/realtek/rtw88/usb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index 64e1c3420e0a..56ca4496b2e6 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -1371,6 +1371,7 @@ void rtw_usb_disconnect(struct usb_interface *intf)
 	rtwusb = rtw_get_usb_priv(rtwdev);
 
 	rtw_usb_cancel_rx_bufs(rtwusb);
+	cancel_work_sync(&rtwusb->rx_work);
 
 	rtw_unregister_hw(rtwdev, hw);
 	rtw_usb_deinit_tx(rtwdev);

base-commit: af32da41b0327b9c6a37856ba82b6760d6c8d10e
-- 
2.56.0