From nobody Sun Jun 14 22:32:28 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gdp0X6SRgz6hZy9 for ; Sun, 14 Jun 2026 22:32:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gdp0X41fZz3cMm for ; Sun, 14 Jun 2026 22:32:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781476348; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6D3foIzjLSqwE0gFYFcu1Ee1j4jK1bceoQFEa+Nl5AY=; b=oNY5s+8dwxKMxYNqaoim1TpuLPEZhwjb86Rckwpoeb8QXYNGrATrnoehogPbf0UMVKSEzX +7mIm88Ra+AejBS3q+RlCqS++47LPQD0qS/D2YjP0VMeG472c6w5C0mW+9aqbQqcaSoKov jZcjE9udOmGwNKCEzNCkfwNaoE4gJxxBQ9VAdBd6i2QO/Jm9gvWJa3ph8r9Qc2PUHeMFhN NTOc8lvkso3HORvR6HkfRl9T5Gf+jWuHd0Y7U2FNorfaQUgC17/JEcJjQRZgqnkHu3vhiF 8vnpb6wdgvUXZOBzdO1C9x6GwfIShyRNqR93Oa3hvkUnazjs0WN/btTjHeGiCA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781476348; a=rsa-sha256; cv=none; b=UAdCv5DOSNdiQ7QO8XqLIl7hxLi7GVS9g7lQ3uNJgSJ+70mRIIqbggDXykS9tlxym23jd0 QsaVsh9Bff5Hbp5zrtlLnxtG1s1bf1Fbskb40ucIqDwcPQM4YoK+JSunOfFluBCFK6KCMb uQXvsFuS52WtwWFFn7/4+LsD6+Wz8ktC97i6/x93E5QPtuPLtV1cyIUIDRq5BypV1Ywglk S+KkmjXC7MmuC4QLtvAvHZUI8UMdgkxD0Xz9B2gThwt6hi4aDy+d3EK+6dQPTBQUBodQgU kl/QX2qHMtbM3+aGfQ74uavK+tUT6VGDgYTPXPmWY030VvBfMA828vIWUw4Bkg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781476348; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6D3foIzjLSqwE0gFYFcu1Ee1j4jK1bceoQFEa+Nl5AY=; b=OVe2vwCdptdlIrdgJvKiRkcjGRtohZydPDLCmjbZmm/RCWaWb0pyyPk4STCSX7OZI3BwQx bTfEexJuQu74rkVRNNw0YrlVacVHfq6Gb3wqhkQcPmHyuFFTheuKrtzfQoIB1zqGGP3yJZ 8aY7hYvFKbwJHZzg7Cz7D554317nmNPVTXph1FSdzr2H8riqUARwbyGrKh9HB6ZUQZwr57 XPLvTIa4/usZv5Pn+yFp2M2bKQ8xwL407P9G12/jhJj6kf0TgrESxE13IvjusWs47+GCIJ Pz/cfvkoqkGoERXegWiG6Mz9CrUlYWoVw6wwVxkIWEm8Rlp8bV53OcDBoecipw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gdp0X39ywzCKg for ; Sun, 14 Jun 2026 22:32:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 434e1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 14 Jun 2026 22:32:28 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 009d92b25f7c - main - mt76: mt7921: prevent PM from scheduling another delayed work on detach List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 009d92b25f7c2d6ddf3fb4202d0a6a4612a716f1 Auto-Submitted: auto-generated Date: Sun, 14 Jun 2026 22:32:28 +0000 Message-Id: <6a2f2bfc.434e1.464e6810@gitrepo.freebsd.org> The branch main has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=009d92b25f7c2d6ddf3fb4202d0a6a4612a716f1 commit 009d92b25f7c2d6ddf3fb4202d0a6a4612a716f1 Author: Bjoern A. Zeeb AuthorDate: 2026-06-14 16:37:10 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-14 22:31:38 +0000 mt76: mt7921: prevent PM from scheduling another delayed work on detach Amongst others mt76_connac_pm_unref() is calling mt76_connac_power_save_sched() which will (normaly) re-schedule the pm_work. In various parts we also cancel that work, also during PCI detach ("shutdown", "remove" in LinuxKPI terms). However we also keep calling mt76_connac_pm_unref() in the detach path and thus we get to a point where we re-scheduled the work but then the device goes away. At that point LinuxKPI delayed work has a callput pending which is embedded in the work structure (pm_work). The moment we free the device that structure and callout is gone but the callout is still on the list and once that list is walked we panic. Simply prevent mt76_connac_power_save_sched() from getting to the point of possibly re-scheduling the pm_work by setting pm->enable to false in the beginning of the detach path. The are likely more paths which will need the same treatment as the code is by far anything from "symmetric" (that is the attach path is highly bus independent while the detach path is implemented per-bus). Also other chipsets share the same "logical paths" with their own names, so they will need this too once we get to them. Sponsored by: The FreeBSD Foundation MFC after: 3 days --- sys/contrib/dev/mediatek/mt76/mt7921/pci.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sys/contrib/dev/mediatek/mt76/mt7921/pci.c b/sys/contrib/dev/mediatek/mt76/mt7921/pci.c index 46b59c4d0390..b70335aba6bf 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7921/pci.c +++ b/sys/contrib/dev/mediatek/mt76/mt7921/pci.c @@ -51,6 +51,17 @@ static void mt7921e_unregister_device(struct mt792x_dev *dev) if (dev->phy.chip_cap & MT792x_CHIP_CAP_WF_RF_PIN_CTRL_EVT_EN) wiphy_rfkill_stop_polling(hw->wiphy); +#if defined(__FreeBSD__) + /* + * Prevent scheduling ps_work again in mt76_connac_power_save_sched(). + * Otherwise upon shutdown we may have delayed work pending, which on + * FreeBSD means there is a callout running, but the ps_work will be + * freed along with the mt792x_dev and so there is a callout on a list + * which no longer exists. + */ + pm->enable = false; +#endif + cancel_work_sync(&dev->init_work); mt76_unregister_device(&dev->mt76); mt76_for_each_q_rx(&dev->mt76, i)