Forwarded: [PATCH 1/1] move callback

[syzbot <syzbot+c99d17aa44dbdba16ad2@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH 1/1] move callback
Author: jakovnovak30@gmail.com

#syz test

---
 drivers/net/wireless/marvell/libertas/firmware.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/marvell/libertas/firmware.c b/drivers/net/wireless/marvell/libertas/firmware.c
index f124110944b7..129aed503ff0 100644
--- a/drivers/net/wireless/marvell/libertas/firmware.c
+++ b/drivers/net/wireless/marvell/libertas/firmware.c
@@ -19,13 +19,17 @@ static void lbs_fw_loaded(struct lbs_private *priv, int ret,
 
 	lbs_deb_fw("firmware load complete, code %d\n", ret);
 
-	/* User must free helper/mainfw */
-	priv->fw_callback(priv, ret, helper, mainfw);
+	/* save cb for later because it can be interrupted */
+	lbs_fw_cb cb = priv->fw_callback;
 
 	spin_lock_irqsave(&priv->driver_lock, flags);
 	priv->fw_callback = NULL;
 	wake_up(&priv->fw_waitq);
 	spin_unlock_irqrestore(&priv->driver_lock, flags);
+
+	/* User must free helper/mainfw */
+	cb(priv, ret, helper, mainfw);
+
 }
 
 static void do_load_firmware(struct lbs_private *priv, const char *name,
-- 
2.53.0