Re: [syzbot] [libertas?] INFO: task hung in lbs_remove_card

[Hillf Danton <hdanton@sina.com>]

> Date: Fri, 27 Feb 2026 03:22:26 -0800	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    bb375c251ab4 dt-bindings: usb: st,st-ohci-300x: convert to..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1141755a580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f1500201919951cc
> dashboard link: https://syzkaller.appspot.com/bug?extid=c99d17aa44dbdba16ad2
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1191555a580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=114a15c6580000

#syz test

--- x/drivers/net/wireless/marvell/libertas/firmware.c
+++ y/drivers/net/wireless/marvell/libertas/firmware.c
@@ -111,9 +111,20 @@ next:
 	do_load_firmware(priv, iter->helper, helper_firmware_cb);
 }
 
+static bool lbs_check_fw_loaded(struct lbs_private *priv)
+{
+	unsigned long flags;
+	bool rc;
+
+	spin_lock_irqsave(&priv->driver_lock, flags);
+	rc = priv->fw_callback == NULL;
+	spin_unlock_irqrestore(&priv->driver_lock, flags);
+	return rc;
+}
+
 void lbs_wait_for_firmware_load(struct lbs_private *priv)
 {
-	wait_event(priv->fw_waitq, priv->fw_callback == NULL);
+	wait_event(priv->fw_waitq, true == lbs_check_fw_loaded(priv));
 }
 
 /**
--