From nobody Sat Oct 17 21:38:06 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j6Zt71wXsz6wqX2 for ; Sat, 17 Oct 2026 21:38:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j6Zt674kbz559B for ; Sat, 17 Oct 2026 21:38:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792273087; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VNpVg7qEz9pEmdDWGT6LqN0WrmlFRaedHkCci1i4iAE=; b=h7qcvt3FJ60SUK8hIanTpdz1nKgN2OZMUwnKWf3nGvRGdNRC9IShuob6dZLbDUP1dhH2+Q o8mhfcuAuiuoQHcNDURqaUfRrXIuq745SSRNYJF17Fdi3w8eJx83V5W27Zwf2zQ2DL5XVT Jbw1vUmuzEU3V2XWQm3PR2b6m1xZ+erOY2EzndHIL7eR93CyNx61cXhWwYuK35slybMVn7 BUM8VqjrWGWurr6m3/IWCtXpbE+LNtFpv8CCrc4h8HGvmFjN92uuST4TTksLrXW+0297PJ V8ib0vzIEYqKtv/JNw7fvQZsqeP7R6EYq59q1cK7/YQD19g4K8Wv7D4xrjCe6Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792273087; b=RMgr4xJiyrvnygEjO94jrgkl/PPotFFnv6Gspp3hbSjBkE5YTnopfnt2ArNsGotmlvU1xV rnDY3S5VVQDFyQDO7Bmq+mrfWy5Z/P5qQ2ZME3dMYbENEEbAi9lK4r5obMcm6xQzovdyzj f5nBdjxfPYHjDF2HvFqqEr7kuMR2l0AXLIz8craaXOIWhhrJU5f7qPoA2AUs6/FH1/XZaS AbNi5iLVt/ovSr6atKZf2kUg2p23HEn9M7T9hc46u9/jG7cesLgQn1QZqbxWGEY9DHfYiP Re5yVu8q6PWgXbVeMyILE7JIO9sBtsHWBtP/NQ9YHF2VzHbn6Y0whdAHZxSvtw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792273087; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VNpVg7qEz9pEmdDWGT6LqN0WrmlFRaedHkCci1i4iAE=; b=msq2hz7Ibx0hz3Px4Bbhax1oGAQK/nzV+fohfAJK+tohJnJSmvoBFiW7kPnx9gt8jAmxSI qFcbi99zGcTu72/ohW3JDY8AYTMymfnBvZy8fhvGD+fTAZBopdeYieLqZseoHFjwclAgoX inwxdlGoqU8rMuAseu+o7SI/O5/jY0xOuzKrutPJyNhFhxJ0Zgpz2HL/H9uuVxoLJccIEl EeJzZ+vhcIx6BAdagKgPf9ipA8udSLZbRtSQqydDwNTE/aI7d7fwOD9xN/K8DpMgZpoN+g xZx6prcBacqmOB1rK0UKm9zrOk9pnV2Ambkf+CVy0icQARenc9zQ8rSV2nTqMQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j6Zt66TsJzJwK for ; Sat, 17 Oct 2026 21:38:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3f021 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 17 Oct 2026 21:38:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Adrian Chadd Subject: git: 37337c499474 - main - iwm: fix incorrect mutex / crash use during error detach path List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: adrian X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 37337c4994745b8143f240fd1b9f64c4255b58fc Auto-Submitted: auto-generated Date: Sat, 17 Oct 2026 21:38:06 +0000 Message-Id: <6ad3eabe.3f021.70c4ba6a@gitrepo.freebsd.org> The branch main has been updated by adrian: URL: https://cgit.FreeBSD.org/src/commit/?id=37337c4994745b8143f240fd1b9f64c4255b58fc commit 37337c4994745b8143f240fd1b9f64c4255b58fc Author: Adrian Chadd AuthorDate: 2026-10-17 21:31:45 +0000 Commit: Adrian Chadd CommitDate: 2026-10-17 21:31:45 +0000 iwm: fix incorrect mutex / crash use during error detach path My previous commit (b3ef4013a4) added a couple of lock assertions. However, the detach assertion is wrong - if the driver hasn't attached then detach needs to be a no-op and this includes not touching a deinit'ed mutex. So, move the mutex check and use until after the attached check. This fixes the driver crash I saw when another bit of in-flight work caused attach to fail, and thus iwm_detach() -> iwm_detach_local() ended up trying to use a deinit'ed mutex, leading to a crash. Fixes: b3ef4013a4fa75063930d0221a0bc50f95af0527 Differential Revision: https://reviews.freebsd.org/D60821 --- sys/dev/iwm/if_iwm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/sys/dev/iwm/if_iwm.c b/sys/dev/iwm/if_iwm.c index 083c316e118e..94963c17312c 100644 --- a/sys/dev/iwm/if_iwm.c +++ b/sys/dev/iwm/if_iwm.c @@ -7104,13 +7104,17 @@ iwm_detach_local(struct iwm_softc *sc, int do_net80211) device_t dev = sc->sc_dev; int i; - IWM_LOCK_ASSERT_UNLOCKED(sc); - - IWM_LOCK(sc); + /* + * Note: this is called during detach where the attach path + * didn't entirely attach all state. Thus mutexes may not + * be initialised here. + */ if (!sc->sc_attached) { - IWM_UNLOCK(sc); return 0; } + + IWM_LOCK_ASSERT_UNLOCKED(sc); + IWM_LOCK(sc); sc->sc_attached = 0; sc->sc_flags |= IWM_FLAG_STOPPED; IWM_UNLOCK(sc);