diff options
| author | Jiangshan Yi <yijiangshan@kylinos.cn> | 2026-08-15 20:10:43 +0800 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-09-15 11:52:56 +0200 |
| commit | 1eeca1d5e0920fbdad6449768fd2d4364e714180 (patch) | |
| tree | 292c97d02b6da107103c4f46562427fbe67da82e | |
| parent | 621d90169cef6c8da5b6134db5c0c4e23cdd09ce (diff) | |
| download | linux-next-1eeca1d5e0920fbdad6449768fd2d4364e714180.tar.gz linux-next-1eeca1d5e0920fbdad6449768fd2d4364e714180.zip | |
wifi: brcmsmac: fix UAF in brcms_free_timer()
brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous
cancel_delayed_work() to cancel the timer's underlying delayed work. If
the work callback (_brcms_timer) is already running, cancel_delayed_work()
returns false without waiting, and brcms_free_timer() proceeds to kfree(t)
while the callback still accesses t through container_of().
Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to
guarantee that any in-flight callback has completed before the timer
structure is freed.
Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260815121043.938414-1-yijiangshan@kylinos.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c index 6255d673d2d3..c1a2318d7ea6 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c @@ -1571,6 +1571,10 @@ void brcms_free_timer(struct brcms_timer *t) /* delete the timer in case it is active */ brcms_del_timer(t); + /* Ensure the callback has finished before freeing the timer + * structure, since brcms_del_timer() uses non-synchronous cancel. + */ + cancel_delayed_work_sync(&t->dly_wrk); if (wl->timers == t) { wl->timers = wl->timers->next; |