The issue is reported at: https://github.com/QubesOS/qubes-issues/issues/7294

`mt7921_pci_remove` seems to always crash whenever it is called.

This can be reproduced by echoing the pci address of wifi device (for example `0000:00:07.0`) to `/sys/bus/pci/drivers/mt7921e/unbind`.

I have read the kernel source code and have a guess.

```
static void mt7921_pci_remove(struct pci_dev *pdev)
{
	struct mt76_dev *mdev = pci_get_drvdata(pdev);
	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);

	mt7921e_unregister_device(dev);
	devm_free_irq(&pdev->dev, pdev->irq, dev);
	pci_free_irq_vectors(pdev);
}
```

From my newbie kernel knowledge I suspect that `mt7921_pci_remove` should first call `devm_free_irq` and then `mt7921e_unregister_device`, due to the reason that `devm_free_irq` calls `free_irq` that "does not return until any executing interrupts for this IRQ have completed" according to the comment there, and that when IRQ for mt7921 is being handled, it 100% uses some fields in `dev`, so before that `dev` cannot be unregistered.

My original email is in https://lore.kernel.org/linux-wireless/153f1a0c.36a0.17fba8be75c.Coremail.logoerthiner1@163.com/T/ however it seems that maillist is not the correct place.