request_firmware_nowait() may invoke the callback before the requesting context resumes. When a firmware lookup fails, the callback starts the next fallback request. That nested request can exhaust the fallback list, complete fw_done, and let disconnect free hif_dev before the parent request returns. The parent then dereferences hif_dev only to print a successful-request message. Remove that post-request access so completion cannot leave an older callback using the freed device state. Fixes: e904cf6fe230 ("ath9k_htc: introduce support for different fw versions") Reported-by: syzbot+cb7ed9d85261445a0201@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cb7ed9d85261445a0201 Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen --- drivers/net/wireless/ath/ath9k/hif_usb.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index 515267f48d80..aaf924cb8860 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -1222,9 +1222,6 @@ static int ath9k_hif_request_firmware(struct hif_device_usb *hif_dev, return ret; } - dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n", - hif_dev->fw_name); - return ret; } -- 2.54.0