CHROMIUM: mwifiex: use-after-free in mwifiex_fw_dpc() failure path

We might be free'ing 'adapter' in mwifiex_free_adapter(). So grab the
pointer to the parent interface's completion *before* we do that.

TEST=reboot tests with slub_debug; or, artificially force FW init failure

Change-Id: I3491e74a11fb73ea4f8b353fc93566e8c985e5bb
Fixes: b040b947422a ("CHROMIUM: mwifiex: resolve races between async FW init (failure) and device removal")
Signed-off-by: Brian Norris <>
Reviewed-by: Douglas Anderson <>
(cherry picked from commit a51189cccc5dd71619da7179fcebfd2e34fbe1b4)
1 file changed