From nobody Mon Jun 29 06:34:23 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc275gytz6k5HT for ; Mon, 29 Jun 2026 06:34:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc273blBz4GnG for ; Mon, 29 Jun 2026 06:34:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JuEaeHXlOV96RhR44TMXBY9Y/r9ZWngASOKT8ZP4K2c=; b=UUxFi7mAhP9pgEq9kGJOku1BhdaQc1D/Atia8MfTPECgDbZdBGEyOkjkOdA4HF9PSzBLjc Df45pI8EilQ6Zow0HmqIoUrPloJTvLRaGPuhi3RA9sPoET1yT4WE0DRqMVu+i2NizUXW8Q 9uF489QFfj8Vlb/W1VK2wyDQJ66IG6daZfKcwsLcnuXrjfI/LSrloGJILxtks/58eKf/52 VX2Lsu339PaoLttCFhBEm5CfAJCe9SJLhDt3AnkJFCJeRauRXcabRRQwQVQxQTJ+1CWRea CLogx84YDtmF8fLMU/G1jtIYrwAzoKdx69oK5NW8o4+5h+hnwbWyD1L1/cCi9Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714863; a=rsa-sha256; cv=none; b=TDGt+1JSh8qlTg8KTFyFGwW69bH32vFIMzl7pBnhyamjV94dYysctrYPHu/+YNs0xyjro7 F9AcVkRKQQjO3q0bDqAuSB5024s5U+hlq2/wysBcAnTQ1PzZknnop1tTsQJ9KZmqaGwmXW 1fLYkXB5ikp124omW0oES0ci9DLHOSjNnu/2KLerZWc4MNuX5Peg++hEiw+Yu8qU+Gh7xJ awjrEGdmg7C3dOmVCMwDIgh+qprAuRYtjTyPMMK8LoJdEt0EWET0b1MO0jTGsVLEDetMYX jJs63ic0oQdcLs4yoWTICgwWEAsRvio3vwl5PXP07AowL3FyBaABO77mPBI7Sg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JuEaeHXlOV96RhR44TMXBY9Y/r9ZWngASOKT8ZP4K2c=; b=xqdEP18JOnjVsjKodALjHtMKBHmmCxP9vJMhG80YaTWV6lo5ALqp/eMhx9C8SgDmtvksw7 fzZAZ/Yac4Ewvp4sLZyj4jD5/m02gRC4w6/lzqT0VHswUQz7i0AHvhjSznnUxWj81SKjJP xipu+ZbS2C2P/3U4I+k21KBvl3LQ2IjhwrpJpYc3uYP8eY6DwLrmB8k3xfMTxYyXjG+FTZ EyjgR3YM8/0dCx0I+IkdzTmgJYAWLPLL24pPOwSWjrDRrOW0KnCanABRO80nRFk17GCmZN UwZQ6vDl9CQ9+kTSaff1a95tZRDjFSE6U+BIdpshpBvs/L8Ew5WRFoYF+0rv2Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc272THMzlmR for ; Mon, 29 Jun 2026 06:34:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46a89 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:23 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: fc1c1ff8e28f - stable/15 - mt76: mt7921: prevent PM from scheduling another delayed work on detach List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: fc1c1ff8e28f9f4bcbbd329d782930d1c4d76da9 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:23 +0000 Message-Id: <6a4211ef.46a89.5c719ee1@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=fc1c1ff8e28f9f4bcbbd329d782930d1c4d76da9 commit fc1c1ff8e28f9f4bcbbd329d782930d1c4d76da9 Author: Bjoern A. Zeeb AuthorDate: 2026-06-14 16:37:10 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:08 +0000 mt76: mt7921: prevent PM from scheduling another delayed work on detach Amongst others mt76_connac_pm_unref() is calling mt76_connac_power_save_sched() which will (normaly) re-schedule the pm_work. In various parts we also cancel that work, also during PCI detach ("shutdown", "remove" in LinuxKPI terms). However we also keep calling mt76_connac_pm_unref() in the detach path and thus we get to a point where we re-scheduled the work but then the device goes away. At that point LinuxKPI delayed work has a callput pending which is embedded in the work structure (pm_work). The moment we free the device that structure and callout is gone but the callout is still on the list and once that list is walked we panic. Simply prevent mt76_connac_power_save_sched() from getting to the point of possibly re-scheduling the pm_work by setting pm->enable to false in the beginning of the detach path. The are likely more paths which will need the same treatment as the code is by far anything from "symmetric" (that is the attach path is highly bus independent while the detach path is implemented per-bus). Also other chipsets share the same "logical paths" with their own names, so they will need this too once we get to them. Sponsored by: The FreeBSD Foundation (cherry picked from commit 009d92b25f7c2d6ddf3fb4202d0a6a4612a716f1) --- sys/contrib/dev/mediatek/mt76/mt7921/pci.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sys/contrib/dev/mediatek/mt76/mt7921/pci.c b/sys/contrib/dev/mediatek/mt76/mt7921/pci.c index 46b59c4d0390..b70335aba6bf 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7921/pci.c +++ b/sys/contrib/dev/mediatek/mt76/mt7921/pci.c @@ -51,6 +51,17 @@ static void mt7921e_unregister_device(struct mt792x_dev *dev) if (dev->phy.chip_cap & MT792x_CHIP_CAP_WF_RF_PIN_CTRL_EVT_EN) wiphy_rfkill_stop_polling(hw->wiphy); +#if defined(__FreeBSD__) + /* + * Prevent scheduling ps_work again in mt76_connac_power_save_sched(). + * Otherwise upon shutdown we may have delayed work pending, which on + * FreeBSD means there is a callout running, but the ps_work will be + * freed along with the mt792x_dev and so there is a callout on a list + * which no longer exists. + */ + pm->enable = false; +#endif + cancel_work_sync(&dev->init_work); mt76_unregister_device(&dev->mt76); mt76_for_each_q_rx(&dev->mt76, i)