1:  e84e72a4c466 ! 1:  24b57293dbaf wifi: rtw88: usb: stop RX work before unregistering hardware
    @@ Commit message
         the RX worker running after mac80211 hardware is unregistered. A firmware
         event can then queue C2H work onto a destroyed workqueue.
     
    -    rtw_usb_disconnect() kills active RX URBs and unregisters the hardware
    -    without disabling rx_urb_work or canceling rx_work. The resubmission work
    -    can restart a killed URB, while an in-flight RX worker can keep processing
    -    packets during teardown.
    +    rtw_usb_disconnect() kills the RX URBs but does not cancel rx_work,
    +    which their completions may already have queued. rxwq is destroyed only
    +    after rtw_unregister_hw().
     
    -    Disable rx_urb_work before killing the active RX URBs, then cancel
    -    rx_work synchronously before unregistering the hardware.
    +    Cancel rx_work synchronously after killing the RX URBs. Only a
    +    successful RX completion queues rx_work, and no RX URB can be
    +    resubmitted at this point: rtw88 does not set soft_unbind, so the USB
    +    core disables the endpoints before it calls rtw_usb_disconnect().
     
         LLM assistance was used to find the bug and review.
     
         Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
    -    Fixes: 3e3aa566dd18 ("wifi: rtw88: usb: Preallocate and reuse the RX skbs")
    -    Cc: stable@vger.kernel.org # needs adjustments for <= 6.13
    +    Cc: stable@vger.kernel.org
         Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
     
      ## drivers/net/wireless/realtek/rtw88/usb.c ##
     @@ drivers/net/wireless/realtek/rtw88/usb.c: void rtw_usb_disconnect(struct usb_interface *intf)
    - 	rtwdev = hw->priv;
      	rtwusb = rtw_get_usb_priv(rtwdev);
      
    -+	/* Stop deferred resubmission before killing the active RX URBs. */
    -+	disable_work_sync(&rtwusb->rx_urb_work);
      	rtw_usb_cancel_rx_bufs(rtwusb);
     +	cancel_work_sync(&rtwusb->rx_work);