From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 54BD8331EAE for ; Tue, 23 Jun 2026 06:33:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782196422; cv=none; b=DFqtu2giiCLK2gOiSBS08XiXPe2b2XbdtmMRUmGxqYk29FnQj5swj2LBF9mogw9eyfHeTVre6Of50nGMN8LPjpqJBqOQdNzmgbawTq/P9esHclQJsybs8QZBGS/r+D75MjFMUyU+AQ4sV2Rbmu/mvGccjj2nHJrJi1W+OLiw2N8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782196422; c=relaxed/simple; bh=etbJ2oo+uM1CMJV3SVt3i6CLWP3m1olRE2mzZkP/jqc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=PfWc0N8IgBmatIPa4/KT0uYb2GtEQGhQl5RMhQEYxAl/nm64eRePnSMe7aZTWaK/VcbdnhKOo9lUPxNwQiJ7Fi9kVE9ZlVefyck+/ZBFsvE/5sVroIq0m/RzilXnyK+FmrVcjQfla09rmrLkS1rwFhlF7CviOJiWZHZsRBBLVH0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=oiNixrV6; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=T06ynyFU; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="oiNixrV6"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="T06ynyFU" Received: from pps.filterd (m0279870.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65N6CBns3567894 for ; Tue, 23 Jun 2026 06:33:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= etC2UpUQyiixtRZefzGaiIsxGOMjL3UeeleogTdY9wI=; b=oiNixrV6RHoi+er1 NcKPqrwFvYTdeMe8mf78gfX+Xll1kGA2a0RqiXCulksijwMJWuVtDm3qSMegJopJ kLjTPZYug6guhQ8N8bEYifDrl9yvqxNfyixAV1qGTPRwp2xO2npmwp4MLmemZeAC xC+14HiGQG3cGmxSxhzxlDseZdITnO4ngao2n6y/39pprwKH+rYUMeEb1u5d4vZC bd/vqGEEsOwWl4tOPODtumyS8sv++aAjRHMpQXKreSg/zoeV0dwOSPf3P38DrJmb q0AfzvPNvZFbqYKDtg6iDhpNkbUH023PwT2KfNkqnv2ZoepnczRpCRyozt8357nd 6RmpPQ== Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4eymnvr2rs-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 23 Jun 2026 06:33:39 +0000 (GMT) Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-c892143db7fso3540188a12.1 for ; Mon, 22 Jun 2026 23:33:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1782196418; x=1782801218; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=etC2UpUQyiixtRZefzGaiIsxGOMjL3UeeleogTdY9wI=; b=T06ynyFUWoElTJWYraztrST/XF8kynrYwjbowdTceELJezK1CJ4JeG0XZAdtJ/Buq8 SVmODEFbYJIboTuW4MHNGeCpMJ1pzP5wvKFcqg2S5AYNqm2YUOL3UjNrqCdEzX/7qWBw hgK+zResOaoV2ldhugbIzpcgzITf5UsouXgubNlERS1p0VSiaHKKH7WhuXMjd0QBz8Cx cDAqoG5JlLiF5P5CF7dZlLdlsXzWjxo1BDbgnkfGJN7UmSm1oKjl7RsJGKH6l0S1ApCb jHirlJ4bnS6CTYc/X+Cl+JjDuNtGt2ef3yn0/ce28Mu8xmaX3S5acbA8PoqPmggDSmvV Jc0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782196418; x=1782801218; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=etC2UpUQyiixtRZefzGaiIsxGOMjL3UeeleogTdY9wI=; b=NpVtFLDY3oTc0BUqHRqyFHx3KzlFlx3bcdgEV2Lgv6IRNAxgh+5KEap83EcsrlHBXA FK1Sm8ZUFKmRkOPEQiVq1Tv4Qpw59xwWotTm/nzJ9VYpa+eHqN33uPVOX7DohiwAep22 RzLfvCIvteZsBi/HNcR+NTpSaZnXJkXFqOOip0waeFizPCkzi+UqCYBonaCgvL7kWLQT 46GyF0WHdJ42i7/4CPE4LkFKSZuNR5oovr14zhfpJSrcvR2mKPXryL+gP8UZBDfslid3 8vleou6nqPug6hg1FRel4elJQNwN8F2h2IfYjEUYDsy7ONhlBcMDJeKcFPmiDqH6ogyX eeww== X-Forwarded-Encrypted: i=1; AFNElJ9j+cCbgG9oa2fuWkW3Ygqd3av7xWVCK00muGDz/L2+pSph/tkSzV7AVxkI/jaj6pMSqFhPdzmOH0sqQWc=@vger.kernel.org X-Gm-Message-State: AOJu0YyU3HDlD6voXpKxP2/N7hPqfp98zaO/HAc6ANwu2+Jg8t+xOIRI 38qoftVJ94gv0dSdUQoKMCn/EOyJIYQEkXxbwrn8SeiHZpkCy8aQUgq1WGyvBpwfTBcEUxb+5LZ MRhzSbOji0i4+/c4rcRQdEJDvde1gvqDLCh/AbaJ9BCMoDvo+TnYLCgg1JUkPjjK2dYI= X-Gm-Gg: AfdE7cnxRZXzXkDHHP0TydCqqORB+mc9Mgst4zmfnpT/HNHdp0FjpXvEjProKtjfgZC ZqQlbo1qZnnKai7Gkq7vnv8dw2INQVuiH8xsFszlGSzKUkV0LcTPowo0s8zxQW8wT9o1BC9AEkg TwwwzofZf6wL9Rp/erdZK7r3OZfW76ZdE3eGz24kqzeZHdHYXeaKeRhtbenvK47LTvJDS7V9BIN nNP0S4chuBbBvVEc3tlcbT91K1WbzvIkCE4k1+rjWmoQvfxOVtJ94DA+wmmJhGU05O1D3Jy2yeJ jSshy4Al8QI/jYrLYyaO6lCLLwto/D2jcdsvDyzPDpHswc039NEev1Cjxo8X+qOkDxeuN8Ksx87 ZuAF/QpeMWH1Fy1Wx7lAnQV3VHt7je5XKrYUD5dvgVyWSB61ZxFhmVK0Hg7PZ X-Received: by 2002:a05:6a00:230c:b0:82c:e9cc:f61d with SMTP id d2e1a72fcca58-845507864b4mr19402320b3a.9.1782196418163; Mon, 22 Jun 2026 23:33:38 -0700 (PDT) X-Received: by 2002:a05:6a00:230c:b0:82c:e9cc:f61d with SMTP id d2e1a72fcca58-845507864b4mr19402234b3a.9.1782196416901; Mon, 22 Jun 2026 23:33:36 -0700 (PDT) Received: from [10.137.71.130] ([106.198.36.229]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84564ecad79sm10674704b3a.50.2026.06.22.23.33.32 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 22 Jun 2026 23:33:36 -0700 (PDT) Message-ID: <1da2b466-ffbe-4aae-9a31-7c6177bdf525@oss.qualcomm.com> Date: Tue, 23 Jun 2026 12:03:30 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath6kl: fix use-after-free in aggr_reset_state() To: Jeff Johnson , Daniel Hodges , linux-wireless@vger.kernel.org Cc: tglx@kernel.org, mingo@kernel.org, joe@perches.com, vthiagar@qca.qualcomm.com, rmani@qca.qualcomm.com, jouni@qca.qualcomm.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org References: <20260206185207.30098-1-git@danielhodges.dev> Content-Language: en-US From: Vasanthakumar Thiagarajan In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Authority-Analysis: v=2.4 cv=dOWWXuZb c=1 sm=1 tr=0 ts=6a3a28c3 cx=c_pps a=Oh5Dbbf/trHjhBongsHeRQ==:117 a=6/2MXK9rXRWb21GBy9lArw==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=gowsoOTTUOVcmtlkKump:22 a=VwQbUJbxAAAA:8 a=-5zR_lsLDLaSFfFJBCMA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=_Vgx9l1VpLgwpw_dHYaR:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNjIzMDA1MSBTYWx0ZWRfXygLwZaf50apd sFjosejDwDSpwNbrWFT8T41dkw5gkNZD0sb3P2Y5EHixAa7ywwKXuwmvzfwdHTj5QVW76L1OXBI NKkbgCRNCJJXemjfGaYIEBO924U2yT4= X-Proofpoint-ORIG-GUID: M7dJEumA_9al58hQ-f4noLh07Z-IO4TH X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjIzMDA1MSBTYWx0ZWRfX3LK1Pg8GsK5y BPR1riZ/E/REkB01MU4na3PUrwzhl504YxuqFli6CBNHqmNC8iDyV3DMtE/X/fZqNRP1TYo4jU3 0BR/zs9Kwpy+0TDnuunS8O0RoZafFmOT9OOlYMetyyBC4+8y+/Dc1DgRs5sYjwYexbIImp83r62 8fDcL0KZ14TpwUa9CkNrKnsBPTg5KtuOdTRH8UfF6qIM9LthWCAuR6H64Qqe1gnUAbYPElIHM03 ieoMDo/ykY2OGZI8PVy6XUtKyKyXxiKk19Gnyfm7PLod6Y87hw4/U1TZDeHCRGCKbL/2CuM7LcZ 8XbC3tn5m99UahC4Jd1xBWLqS9vXjvjT3ibSVIyr7QsoqNGnN0xzzJw8peZ6qiPYDot5+v+pPda xZZIY3L9h+eusJ64xanBn1aWSjZX+PMI10HPRETG7AQgvf4z8dFthZ4Od8ObmJQbfaWvbq1NlhE U7XXUev2bBj5Z1dT7lA== X-Proofpoint-GUID: M7dJEumA_9al58hQ-f4noLh07Z-IO4TH X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-23_01,2026-06-22_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 priorityscore=1501 impostorscore=0 adultscore=0 bulkscore=0 clxscore=1011 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606230051 On 6/18/2026 7:00 AM, Jeff Johnson wrote: > On 6/17/2026 6:26 PM, Jeff Johnson wrote: >> On 2/6/2026 10:52 AM, Daniel Hodges wrote: >>> The aggr_reset_state() function uses timer_delete() (non-synchronous) >>> for the aggregation timer before proceeding to delete TID state and >>> before the structure is freed by callers like aggr_module_destroy(). >>> >>> If the timer callback (aggr_timeout) is executing when aggr_reset_state() >>> is called, the callback will continue to access aggr_conn fields like >>> rx_tid[] and stat[] which may be freed immediately after by >>> kfree(aggr_info->aggr_conn) in aggr_module_destroy(). >>> >>> Additionally, the timer callback can re-arm itself via mod_timer() while >>> aggr_reset_state() is running, creating a more complex race condition. >>> >>> Use timer_delete_sync() instead to ensure any running timer callback >>> has completed before returning. >>> >>> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") >>> Cc: stable@vger.kernel.org >>> Signed-off-by: Daniel Hodges >>> --- >>> drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> >>> diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c >>> index c3b06b515c4f..25ff5dec221c 100644 >>> --- a/drivers/net/wireless/ath/ath6kl/txrx.c >>> +++ b/drivers/net/wireless/ath/ath6kl/txrx.c >>> @@ -1828,7 +1828,7 @@ void aggr_reset_state(struct aggr_info_conn *aggr_conn) >>> return; >>> >>> if (aggr_conn->timer_scheduled) { >>> - timer_delete(&aggr_conn->timer); >>> + timer_delete_sync(&aggr_conn->timer); >> >> My review agent claims this still doesn't fix the UAF since aggr_timeout() can >> call mod_timer() to rearm itself and hence the timer can fire again. >> Instead it suggests timer_shutdown_sync() should be used since that prevents >> any rearm from taking effect. >> >> But I'm not familiar with this driver so I don't know if there are reasons to >> not use timer_shutdown_sync(), i.e. if the timer will be reused again then >> timer_setup() will need to be called again. > > Interesting enough, another iteration of the same agent says: > **The fix is correct.** `timer_delete_sync()` loops until the timer is both > not-running and not-pending — it handles the re-arm case because after the > callback calls `mod_timer()`, the sync loop picks that up and cancels it. Yeah, my understanding is also that timer_delete_sync() will ensure that the timer will not be pending (including the one armed from the timer callback itself) or running when it returns with the caller ensuring the timer is not rearmed concurrently. With that, I think this code change is fine and no need to use timer_shutdown_sync(). Vasanth