Move MT76_REMOVED flag setting from mt7925_pci_remove() to after mt76_unregister_device() completes. Setting it too early causes mt792x_irq_handler() to drop MCU completion interrupts, timing out teardown commands (scan abort, BSS_INFO_UPDATE, etc). The flag must still be set before napi_disable() to prevent reset_work from re-enabling NAPI and causing deadlock. Also guard mt792x_reset() to skip queuing work when device is removed. Fixes: 896f4dfd68e1 ("wifi: mt76: mt7925: Fix unregister deadlock") Signed-off-by: Eason Lai --- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 4 ++-- drivers/net/wireless/mediatek/mt76/mt792x_mac.c | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c index 02ef09dd797d..93c823eb7501 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c @@ -47,9 +47,10 @@ static void mt7925e_unregister_device(struct mt792x_dev *dev) if (dev->phy.chip_cap & MT792x_CHIP_CAP_WF_RF_PIN_CTRL_EVT_EN) wiphy_rfkill_stop_polling(hw->wiphy); - cancel_work_sync(&dev->reset_work); cancel_work_sync(&dev->init_work); mt76_unregister_device(&dev->mt76); + set_bit(MT76_REMOVED, &dev->mphy.state); + cancel_work_sync(&dev->reset_work); mt76_for_each_q_rx(&dev->mt76, i) napi_disable(&dev->mt76.napi[i]); cancel_delayed_work_sync(&pm->ps_work); @@ -725,7 +726,6 @@ static void mt7925_pci_remove(struct pci_dev *pdev) struct mt76_dev *mdev = pci_get_drvdata(pdev); struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76); - set_bit(MT76_REMOVED, &mdev->phy.state); mt7925e_unregister_device(dev); devm_free_irq(&pdev->dev, pdev->irq, dev); mt76_free_device(&dev->mt76); diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_mac.c b/drivers/net/wireless/mediatek/mt76/mt792x_mac.c index 888e5a505673..1e20b333cc61 100644 --- a/drivers/net/wireless/mediatek/mt76/mt792x_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt792x_mac.c @@ -278,6 +278,9 @@ void mt792x_reset(struct mt76_dev *mdev) if (pm->suspended) return; + if (test_bit(MT76_REMOVED, &mdev->phy.state)) + return; + queue_work(dev->mt76.wq, &dev->reset_work); } EXPORT_SYMBOL_GPL(mt792x_reset); -- 2.45.2