mac80211: brcmfmac: backport fixes from kernel 5.4

This fixes:
1) Crash during USB disconnect
2) Crash in brcmf_txfinalize() on rmmod with packets queued
3) Some errors in exit path

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 8231f67218e584be61d32b24bd17cc55e500638c)

1 files changed, 32 insertions, 0 deletions

diff --git a/package/kernel/mac80211/patches/352-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch b/package/kernel/mac80211/patches/352-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
new file mode 100644
index 0000000000..fd010f2a8f
--- /dev/null
+++ b/package/kernel/mac80211/patches/352-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
@@ -0,0 +1,32 @@
+From dabf1e17d33e087d4e24e6d0224cf9bc04ebfcc1 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 11:05:11 +0200
+Subject: [PATCH 6/7] brcmfmac: simply remove flowring if bus is down
+
+When the bus is down, eg. due to rmmod, there is no need to
+attempt to inform firmware about it.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -1408,6 +1408,13 @@ void brcmf_msgbuf_delete_flowring(struct
+ 	u8 ifidx;
+ 	int err;
+ 
++	/* no need to submit if firmware can not be reached */
++	if (drvr->bus_if->state != BRCMF_BUS_UP) {
++		brcmf_dbg(MSGBUF, "bus down, flowring will be removed\n");
++		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
++		return;
++	}
++
+ 	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
+ 	brcmf_commonring_lock(commonring);
+ 	ret_ptr = brcmf_commonring_reserve_for_write(commonring);