wifi: rtlwifi: wait for firmware loading before releasing memory

[ Upstream commit b4b26642b31ef282df6ff7ea8531985edfdef12a ]

At probe error path, the firmware loading work may have already been
queued. In such a case, it will try to access memory allocated by the probe
function, which is about to be released. In such paths, wait for the
firmware worker to finish before releasing memory.

Fixes: a7f7c15e945a ("rtlwifi: rtl8192cu: Free ieee80211_hw if probing fails")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241107133322.855112-4-cascardo@igalia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index add6da1ce3602e1c9443884d9bf7676f955412e8..087e398da36d972756113b7db16adc8608a1f1ed 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1072,13 +1072,15 @@ int rtl_usb_probe(struct usb_interface *intf,
        err = ieee80211_register_hw(hw);
        if (err) {
                pr_err("Can't register mac80211 hw.\n");
-               goto error_out;
+               goto error_init_vars;
        }
        rtlpriv->mac80211.mac80211_registered = 1;
 
        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
        return 0;
 
+error_init_vars:
+       wait_for_completion(&rtlpriv->firmware_loading_complete);
 error_out:
        rtl_deinit_core(hw);
 error_out2: