[PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit

[PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit

[Rosen Penev]

ath9k_deinit_channel_context() cancels chanctx_work but does not delete
the offchannel and sched timers set up by ath9k_init_channel_context().
If either timer fires after deinit (e.g. during driver unload or
suspend), it accesses sc->sc_ah which may already be freed by
ath9k_hw_deinit(), causing a use-after-free.

Delete both timers with timer_shutdown_sync() before cancelling the work
item.

Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 v2: use timer_shutdown_sync()
 drivers/net/wireless/ath/ath9k/channel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 8b27d8cc086a..cfb1c90eb4b6 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -1363,6 +1363,8 @@ void ath9k_init_channel_context(struct ath_softc *sc)
 
 void ath9k_deinit_channel_context(struct ath_softc *sc)
 {
+	timer_shutdown_sync(&sc->sched.timer);
+	timer_shutdown_sync(&sc->offchannel.timer);
 	cancel_work_sync(&sc->chanctx_work);
 }
 
-- 
2.55.0

Re: [PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit

[Toke Høiland-Jørgensen]

Rosen Penev <rosenp@gmail.com> writes:

> ath9k_deinit_channel_context() cancels chanctx_work but does not delete
> the offchannel and sched timers set up by ath9k_init_channel_context().
> If either timer fires after deinit (e.g. during driver unload or
> suspend), it accesses sc->sc_ah which may already be freed by
> ath9k_hw_deinit(), causing a use-after-free.
>
> Delete both timers with timer_shutdown_sync() before cancelling the work
> item.
>
> Assisted-by: LLM
> Signed-off-by: Rosen Penev <rosenp@gmail.com>

Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>

Re: [PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit

[Jeff Johnson]

On 9/12/2026 1:23 AM, Toke Høiland-Jørgensen wrote:
> Rosen Penev <rosenp@gmail.com> writes:
> 
>> ath9k_deinit_channel_context() cancels chanctx_work but does not delete
>> the offchannel and sched timers set up by ath9k_init_channel_context().
>> If either timer fires after deinit (e.g. during driver unload or
>> suspend), it accesses sc->sc_ah which may already be freed by
>> ath9k_hw_deinit(), causing a use-after-free.
>>
>> Delete both timers with timer_shutdown_sync() before cancelling the work
>> item.
>>
>> Assisted-by: LLM
>> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> 
> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>

I'm picking this up now. Will add the following suggested by my review agent:

Fixes: 705d0bf83dbe ("ath9k: Add a routine for initializing channel contexts")
Cc: stable@vger.kernel.org # v6.2+

Re: [PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit

[Jeff Johnson]

On Fri, 11 Sep 2026 14:31:44 -0700, Rosen Penev wrote:
> ath9k_deinit_channel_context() cancels chanctx_work but does not delete
> the offchannel and sched timers set up by ath9k_init_channel_context().
> If either timer fires after deinit (e.g. during driver unload or
> suspend), it accesses sc->sc_ah which may already be freed by
> ath9k_hw_deinit(), causing a use-after-free.
> 
> Delete both timers with timer_shutdown_sync() before cancelling the work
> item.
> 
> [...]

Applied, thanks!

[1/1] wifi: ath9k: delete channel-context timers on deinit
      commit: 81394dfb9a7905472957628b560ae894eae3a30f

Best regards,
-- 
Jeff Johnson <jeff.johnson@oss.qualcomm.com>