From d3d330f939a4a03207a9a02b43301f278b13f459 Mon Sep 17 00:00:00 2001
From: Bogdan Nicolae <bogdan.nicolae@acm.org>
Date: Sat, 27 Jun 2026 15:33:33 -0500
Subject: [PATCH] brcmfmac: use a valid cookie for management frames

Without a valid cookie to distinguish pending concurrent completion
events, mismatches occur under concurrency that crash the firmware.
This fix uses a monotonous atomic counter that guarantees unique ids.

Signed-off-by: Bogdan Nicolae <bogdan.nicolae@acm.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2022 Broadcom Corporation
  */
+#include <linux/atomic.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <core.h>
@@ -23,6 +24,8 @@
 #define MGMT_AUTH_FRAME_DWELL_TIME	4000
 #define MGMT_AUTH_FRAME_WAIT_TIME	(MGMT_AUTH_FRAME_DWELL_TIME + 100)
 
+static atomic_t brcmf_cyw_mgmt_tx_id = ATOMIC_INIT(0);
+
 static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp,
 				 struct cfg80211_crypto_settings *crypto)
 {
@@ -124,7 +127,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiph
 	if (!ieee80211_is_auth(mgmt->frame_control))
 		return brcmf_cfg80211_mgmt_tx(wiphy, wdev, params, cookie);
 
-	*cookie = 0;
+	*cookie = (u32)atomic_inc_return(&brcmf_cyw_mgmt_tx_id);
 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 
 	reinit_completion(&vif->mgmt_tx);
