datawork is currently initialized in brcmf_attach, but bus_if->drvr is created before this in brcmf_alloc. Both of these functions are called on firmware load, which may race with device removal. If this happens, cancel_work_sync may be called on an uninitialized datawork. Fix this by always initializing datawork before we set bus_if->drvr, as this matches the condition in brcmf_bus_cancel_reset_work. Fixes: 43b25879f004c ("wifi: brcmfmac: drain bus_reset work on device removal") Signed-off-by: Sean Anderson --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index dad6f4563d146..a3163120154dd 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -1298,8 +1298,6 @@ static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops) #endif #endif /* CONFIG_INET */ - INIT_WORK(&drvr->bus_reset, brcmf_core_bus_reset); - /* populate debugfs */ brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read); debugfs_create_file("reset", 0600, brcmf_debugfs_get_devdir(drvr), drvr, @@ -1349,6 +1347,7 @@ int brcmf_alloc(struct device *dev, struct brcmf_mp_device *settings) drvr = wiphy_priv(wiphy); drvr->wiphy = wiphy; drvr->ops = ops; + INIT_WORK(&drvr->bus_reset, brcmf_core_bus_reset); drvr->bus_if = dev_get_drvdata(dev); drvr->bus_if->drvr = drvr; drvr->settings = settings; -- 2.53.0