mt7615_unregister_device() calls mt76_free_device() which destroys the workqueue without first cancelling the coredump.work delayed work. If a firmware coredump is in progress when the driver is unloaded, the pending timer can fire after the workqueue has been freed. Add cancel_delayed_work_sync() for coredump.work in mt7615_unregister_device() before the mt76_free_device() call. Fixes: d2bf7959d9c0 ("mt76: mt7663: introduce coredump support") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c index a9178e077fd6d..c06b0301a4e4a 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c @@ -124,5 +124,6 @@ void mt7615_unregister_device(struct mt7615_dev *dev) mt7615_dma_cleanup(dev); tasklet_disable(&dev->mt76.irq_tasklet); + cancel_delayed_work_sync(&dev->coredump.work); mt76_free_device(&dev->mt76); } -- 2.47.3