git: 37337c499474 - main - iwm: fix incorrect mutex / crash use during error detach path

The branch main has been updated by adrian:

URL: https://cgit.FreeBSD.org/src/commit/?id=37337c4994745b8143f240fd1b9f64c4255b58fc

commit 37337c4994745b8143f240fd1b9f64c4255b58fc
Author:     Adrian Chadd <adrian@FreeBSD.org>
AuthorDate: 2026-10-17 21:31:45 +0000
Commit:     Adrian Chadd <adrian@FreeBSD.org>
CommitDate: 2026-10-17 21:31:45 +0000

    iwm: fix incorrect mutex / crash use during error detach path
    
    My previous commit (b3ef4013a4) added a couple of lock assertions.
    However, the detach assertion is wrong - if the driver hasn't
    attached then detach needs to be a no-op and this includes
    not touching a deinit'ed mutex.
    
    So, move the mutex check and use until after the attached check.
    
    This fixes the driver crash I saw when another bit of in-flight
    work caused attach to fail, and thus iwm_detach() -> iwm_detach_local()
    ended up trying to use a deinit'ed mutex, leading to a crash.
    
    Fixes: b3ef4013a4fa75063930d0221a0bc50f95af0527
    
    Differential Revision:  https://reviews.freebsd.org/D60821
---
 sys/dev/iwm/if_iwm.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/sys/dev/iwm/if_iwm.c b/sys/dev/iwm/if_iwm.c
index 083c316e118e..94963c17312c 100644
--- a/sys/dev/iwm/if_iwm.c
+++ b/sys/dev/iwm/if_iwm.c
@@ -7104,13 +7104,17 @@ iwm_detach_local(struct iwm_softc *sc, int do_net80211)
 	device_t dev = sc->sc_dev;
 	int i;
 
-	IWM_LOCK_ASSERT_UNLOCKED(sc);
-
-	IWM_LOCK(sc);
+	/*
+	 * Note: this is called during detach where the attach path
+	 * didn't entirely attach all state.  Thus mutexes may not
+	 * be initialised here.
+	 */
 	if (!sc->sc_attached) {
-		IWM_UNLOCK(sc);
 		return 0;
 	}
+
+	IWM_LOCK_ASSERT_UNLOCKED(sc);
+	IWM_LOCK(sc);
 	sc->sc_attached = 0;
 	sc->sc_flags |= IWM_FLAG_STOPPED;
 	IWM_UNLOCK(sc);