iwl_pcie_check_me_status() schedules me_recheck_wk a second out when it cannot decide whether CSME is present yet. iwl_pci_gen1_2_probe() calls it before iwl_drv_start(), and if that fails the error path goes straight to iwl_trans_pcie_free() without cancelling the work. The trans, and with it the delayed_work and the trans_pcie the callback dereferences, is freed while the timer is still armed. iwl_pcie_gen1_2_remove() does cancel it, so only the probe error path is affected. Cancel it there too. The window is narrow: reaching the schedule needs both reads in iwl_pcie_check_me_status() to fail, and iwl_pci_probe() already bails with -EIO on an all-ones CSR_HW_REV before iwl_pci_gen1_2_probe() runs, so it takes a device that answers config space and CSR_HW_REV but then fails iwl_trans_grab_nic_access(). I found this by inspection rather than by tripping over it, and I have no way to force that state on the hardware I have. Cc: stable@vger.kernel.org Fixes: 41fff83fe6cd ("wifi: iwlwifi: pcie: check for WiAMT/CSME presence") Signed-off-by: Navon John Lukose --- drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c index 28b276c..a30854d 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c @@ -4369,6 +4369,8 @@ int iwl_pci_gen1_2_probe(struct pci_dev *pdev, if (IS_ERR(iwl_trans->drv)) { ret = PTR_ERR(iwl_trans->drv); + /* iwl_pcie_check_me_status() may have armed this */ + cancel_delayed_work_sync(&trans_pcie->me_recheck_wk); goto out_free_trans; } -- 2.55.0