From 6b6cb960c4f1eedac9ee918168b0417d70729678 Mon Sep 17 00:00:00 2001 From: Bogdan Nicolae Date: Sat, 27 Jun 2026 15:33:33 -0500 Subject: [PATCH] brcmfmac: use a valid cookie for management frames Without a valid cookie to distinguish pending concurrent completion events, mismatches occur under concurrency that crash the firmware. This fix uses a monotonous atomic counter that guarantees unique ids. Signed-off-by: Bogdan Nicolae --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c index 87faac6c68ca25..e44f3b0e1b0754 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c @@ -2,6 +2,7 @@ /* * Copyright (c) 2022 Broadcom Corporation */ +#include #include #include #include @@ -23,6 +24,8 @@ #define MGMT_AUTH_FRAME_DWELL_TIME 4000 #define MGMT_AUTH_FRAME_WAIT_TIME (MGMT_AUTH_FRAME_DWELL_TIME + 100) +static atomic_t brcmf_cyw_mgmt_tx_id = ATOMIC_INIT(0); + static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp, struct cfg80211_crypto_settings *crypto) { @@ -124,7 +127,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, if (!ieee80211_is_auth(mgmt->frame_control)) return brcmf_cfg80211_mgmt_tx(wiphy, wdev, params, cookie); - *cookie = 0; + *cookie = (u32)atomic_inc_return(&brcmf_cyw_mgmt_tx_id); vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev); reinit_completion(&vif->mgmt_tx);