* [PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit
@ 2026-09-11 21:31 Rosen Penev
2026-09-12 8:23 ` Toke Høiland-Jørgensen
0 siblings, 1 reply; 2+ messages in thread
From: Rosen Penev @ 2026-09-11 21:31 UTC (permalink / raw)
To: linux-wireless; +Cc: Toke Høiland-Jørgensen, open list
ath9k_deinit_channel_context() cancels chanctx_work but does not delete
the offchannel and sched timers set up by ath9k_init_channel_context().
If either timer fires after deinit (e.g. during driver unload or
suspend), it accesses sc->sc_ah which may already be freed by
ath9k_hw_deinit(), causing a use-after-free.
Delete both timers with timer_shutdown_sync() before cancelling the work
item.
Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
v2: use timer_shutdown_sync()
drivers/net/wireless/ath/ath9k/channel.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 8b27d8cc086a..cfb1c90eb4b6 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -1363,6 +1363,8 @@ void ath9k_init_channel_context(struct ath_softc *sc)
void ath9k_deinit_channel_context(struct ath_softc *sc)
{
+ timer_shutdown_sync(&sc->sched.timer);
+ timer_shutdown_sync(&sc->offchannel.timer);
cancel_work_sync(&sc->chanctx_work);
}
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit
2026-09-11 21:31 [PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit Rosen Penev
@ 2026-09-12 8:23 ` Toke Høiland-Jørgensen
0 siblings, 0 replies; 2+ messages in thread
From: Toke Høiland-Jørgensen @ 2026-09-12 8:23 UTC (permalink / raw)
To: Rosen Penev, linux-wireless; +Cc: open list
Rosen Penev <rosenp@gmail.com> writes:
> ath9k_deinit_channel_context() cancels chanctx_work but does not delete
> the offchannel and sched timers set up by ath9k_init_channel_context().
> If either timer fires after deinit (e.g. during driver unload or
> suspend), it accesses sc->sc_ah which may already be freed by
> ath9k_hw_deinit(), causing a use-after-free.
>
> Delete both timers with timer_shutdown_sync() before cancelling the work
> item.
>
> Assisted-by: LLM
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-12 8:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 21:31 [PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit Rosen Penev
2026-09-12 8:23 ` Toke Høiland-Jørgensen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®