CVE-2026-64586

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: drain bus_reset work on device removal

brcmffwcrashed() and the debugfs "reset" entry both schedule drvr->busreset, whose callback recovers drvr through containerof() and dereferences it. The removal path frees drvr (brcmffree -> wiphyfree) without draining the work, so a bus_reset callback pending or running during removal can outlive drvr.

Cancellation cannot live in brcmfdetach() or brcmffree(): the work callback reaches teardown through the bus .reset op (PCIe brcmfpciereset -> brcmfdetach; SDIO brcmfsdiobusreset -> brcmfsdiodremove -> brcmf_free), so cancelling there would wait for the running work and deadlock.

Add a per-bus mutex (busresetlock) and route all arming through brcmfbusschedulereset(), which under the lock skips when the bus is marked removing. Each bus remove entry calls brcmfbuscancelresetwork(), which under the same lock sets removing and cancels the work. Holding the mutex across cancelworksync() makes the set-removing + drain step atomic. Every producer reaches the arming path from process context -- the PCIe firmware-halt notification runs in the threaded IRQ handler (brcmfpcieisrthread) and the SDIO hostmail path runs from the data workqueue -- so the mutex is taken only in sleepable contexts. Where applicable the remove entry first stops the firmware-crash producer: on PCIe mask the mailbox and synchronizeirq; on SDIO unregister the bus interrupt and cancel the data worker, which also reports firmware halts through brcmffwcrashed(). The mutex is initialized at bus allocation. The SDIO suspend power-off path frees drvr through the same brcmfsdiod_remove() and takes the same lock; resume re-allows the work only on a successful re-probe.

Also guard brcmffwcrashed() against a NULL busif/drvr: it can fire before brcmfattach() wires up drvr, and it dereferences drvr (bphyerr/brcmfdev_coredump) before reaching the arming gate.

The busreset work is shared across buses, so the drain is applied to every remove path: PCIe (the .reset op introduced by the Fixes commit), SDIO (arms the same work through brcmffwcrashed()), and USB (via the debugfs "reset" entry). cancelworksync() drains a running or pending busreset work item before removal frees drvr, and patch 1/2 makes the scratch-buffer release safe when reset teardown has already released those DMA buffers.

This patch fixes the lifetime of the bus_reset work item itself. It does not attempt to address the separate, pre-existing lifetime of the asynchronous firmware completion started by the PCIe reset path. That callback needs its own lifetime/ownership protocol and is being tracked separately.

This issue was found by an in-house static analysis tool.