When the device drops off the bus, MMIO reads return all ones. The console write index then never matches read_idx, which wraps at bufsize, so brcmf_pcie_bus_console_read() loops forever and floods the kernel log with 0xff characters at several thousand lines per second. Seen on a BCM4366 after a firmware trap followed by a fatal PCIe error (FCP): the reset path and the failed dongle setup both entered the loop and never reached device_release_driver(). Return early when the write index lies outside the console buffer. Found and written with the help of an AI coding assistant (Claude Opus 5.5); the cover letter describes how. Fixes: 9e37f045d5e7 ("brcmfmac: Adding PCIe bus layer support.") Cc: stable@vger.kernel.org Signed-off-by: Soeren Coremans --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c index eca5f5f63bce..02c58de67b82 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -992,6 +992,14 @@ static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo, return; addr = console->base_addr + BRCMF_CONSOLE_WRITEIDX_OFFSET; newidx = brcmf_pcie_read_tcm32(devinfo, addr); + /* A dead device reads back as all ones, an index read_idx never + * reaches; without this check the loop below never terminates. + */ + if (newidx >= console->bufsize) { + brcmf_dbg(PCIE, "invalid console write index %u (bufsize %u)\n", + newidx, console->bufsize); + return; + } while (newidx != console->read_idx) { addr = console->buf_addr + console->read_idx; ch = brcmf_pcie_read_tcm8(devinfo, addr); -- 2.53.0