From da47f2093f90f3641258961a61e8d12e51dd805c Mon Sep 17 00:00:00 2001 From: nomdetom Date: Sun, 11 Oct 2026 03:07:34 +0100 Subject: [PATCH] fix(usb): a scan whose command failed is forgotten, so a late answer cannot finish a freed request rwnx_cfg80211_scan() stores the request in rwnx_hw->scan_request before sending SCANU_START_REQ. When the send fails, the error goes back to cfg80211, which frees the request, but scan_request still points at it. A late SCANU_START_CFM (or the next scan's completion) then calls cfg80211_scan_done() on freed memory. Seen on an AIC8800DC with a command timeout injected during a scan: the kernel panicked in cfg80211_scan_done(), caught twice on the serial console. --- drivers/aic8800/aic8800_fdrv/rwnx_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/aic8800/aic8800_fdrv/rwnx_main.c b/drivers/aic8800/aic8800_fdrv/rwnx_main.c index fca3237..5d03bd5 100644 --- a/drivers/aic8800/aic8800_fdrv/rwnx_main.c +++ b/drivers/aic8800/aic8800_fdrv/rwnx_main.c @@ -2947,8 +2947,10 @@ static int rwnx_cfg80211_scan(struct wiphy *wiphy, } rwnx_hw->scan_request = request; - if ((error = rwnx_send_scanu_req(rwnx_hw, rwnx_vif, request))) + if ((error = rwnx_send_scanu_req(rwnx_hw, rwnx_vif, request))) { + rwnx_hw->scan_request = NULL; return error; + } return 0; }