From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEAAC20125F for ; Thu, 18 Jun 2026 01:30:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781746243; cv=none; b=NLhJrEOX+POR4rw0XYx7Mot2Ab/JIXAxZ4Ly2kf3yPXJd2NUfbS3N5jxcmzUl6xfiBj4HjKY9OB+Z8etu6IGaXjt6kUg2pc8EhcEb1QtgxWTBKpskEjUDYGxrzARtpA3Y8FoOvWXmP0nCmvdS9m5+3/QnzHLW/MjzWHrahKzLBg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781746243; c=relaxed/simple; bh=xXWgGBgQoCldbXSorwbebvXAaddQF+ZKb/qrNLzOp9w=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=Qav4PXDluF2uf48FkXFxSZzqDCDTs/DJ5vOVDkZC4sfIUA5dGxq2ToAb1MWDDuPnVaJyIHkbZtW6Dh/CuNXfMqvyXhv/Ymhq4OgVlWOuoaQfJnzcUXSqexABb+X0L7Io21drTRxM383M6YYcFMpG6G6KTCEGAkIBOKmstI1RvJk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=oziYE+/q; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=BBrckebF; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="oziYE+/q"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="BBrckebF" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65HHd5TA329880 for ; Thu, 18 Jun 2026 01:30:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= iIhvmxaTT/WGeHYzztvI3zMkUGHJTXnzFOaumPvPxFc=; b=oziYE+/qTudazA3o xWayu+2R64MgeYdVieAJQwiyuJgsn9qHnETR9Ol2jGCk1Q3LujXbtqmQImvZ3dLw rlrPypdIIsnUrBposm7kyCqeAHn9VMshguXB0YneGReZZ43FSYW79mW2yR8r/3xQ xhqcTIY0DN5JYhu4jDPRxtXVpS0hh9BT6rLIoAlS08w8iW9tszOr6vsQWCUzhe8i c8VN8l8Jq3WdK7cT0l/nd0bGnOouLf0EOvvAO4kRqVjKV+NdwkdU/klfm39Ak7Tq qFmPPuouHa/1fYWGksrkL264VI8K6v/FUhGIoheQElNMxpYPN8aWsa2kJvXpSUxn mvVo6w== Received: from mail-dy1-f198.google.com (mail-dy1-f198.google.com [74.125.82.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4euw9vjr5q-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 18 Jun 2026 01:30:42 +0000 (GMT) Received: by mail-dy1-f198.google.com with SMTP id 5a478bee46e88-30ba395b047so1708287eec.0 for ; Wed, 17 Jun 2026 18:30:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1781746241; x=1782351041; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:from:subject:user-agent:mime-version:date:message-id:from:to :cc:subject:date:message-id:reply-to; bh=iIhvmxaTT/WGeHYzztvI3zMkUGHJTXnzFOaumPvPxFc=; b=BBrckebFlOCdd0qE2TROz9B2lwxVigLSvvCPM/Q8OBqdfYUiIAFffWiOElPrQrtyu4 4zaGdxoFH4CsNq6pLXr7VNX2Qf/xJMAfZuDpvuoh8CB/IvrPWAnSkRHephDypJ3bTL89 zKCRmps5mgmT8qeuNotOCt+r12KPv9tmr1YDwYKuefhx9uFDlFTme6v2OBgjGJK/U6+r wutAEHodEKToBOfoFVFul+nS9rqLW2i8nscPGicO8HLjQ4XaZ9oN56iZrQahuhnvuPaZ J8zPfP+KyZJZ0Bxk9Kd0gReA7CsV6IgeNL27GyHX7Swh2IkbSDfPoPDsTrJV0qUnidi9 Fa4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781746241; x=1782351041; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:from:subject:user-agent:mime-version:date:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=iIhvmxaTT/WGeHYzztvI3zMkUGHJTXnzFOaumPvPxFc=; b=XGXY+wXm0WlpgiUI0OokXuhnCy8vMCqgDOPe1IIcALnwKToRVDoBXkQlAMr8G8iOXS wr7aG6w4H03DNKUCgZIAIPyPe/qYL6hiP6tJjzd0hisdhxCdI1D31mNHmzTPnj/TC6hI FBdLHa/todMYD9KifCFgyJs1DmA4MFyaHAZldkqcZVNK8JwVEA0OF/G5/MVuYonW6laT pkhfHHT5eRIbAzESD6XK4AT00SLngfUbeSoMJReiU7pLjbKGulC+ChiVcgbqdLbyrOsA J6/oesecw2nL/q++jWrlGfLQ5HhorBn6uOoeBJhXnNQTfhSSpr1vWEgyu4qSukxOrMgD RVTg== X-Forwarded-Encrypted: i=1; AFNElJ8TM+g9a+i0SuhpfRRCHA8cgzUJl0Lr+yIfrcJ+9n3dM80wJ2inw7kRU6oUu0t0+nFP/X2iCOHuZyWHyNE=@vger.kernel.org X-Gm-Message-State: AOJu0Yx5vE56ZlpNrqcXmjI+yVMLydIfJBXX3yNR98muKGLAaUh9Gmvb HIkyOXcUumIFNT/H6MOZ+NKtVvEl6VPvS6NBbQXCg7A5KM8x0jEUh8j0soge5+1TyovURhQ/3R4 HHIxBCrVxgcnJdl++5yMRFLhs2WcyyJ+epkXiZSTNPJDwueRy5IDB80Wg+503mX7jJz8= X-Gm-Gg: AfdE7cnqvz177B1Xel+NpDVhgshfpSjeopDEztt7VFfxqKFRXPPhFeeNAbFFaq2+S6v 2tk79IanP8s0uhfu7sI/xMg5ppkkSowHo4mt2p9hWH+hQPRqgMDzRB884HxUDgSeuzoUvxEUzi2 1s2O/L4+nQm7kbYS55Es8/qJs4P4RtgWEinRhr7y5dZUf1hdnFzxz9GzSrcZBWeiSMGTdTl8Npa QcUl5IX/uHlJ/1U2zCg09u33bZ0bYtzHiBTCTVawxwlkxQhFC5xk/C0yUEIgfkiTxjbN7lGA20i jPL3vU+3cH3txFJwS6ObjctO7KUrGlx6TyqwpMx2lmNYh/jTtcY8a6adDhX9YYsT3yn8rWtVdP/ WJNJPFCJAqb1D5NzEw0zgXS89Hmge5WdAvlq5oK54XFYQfPPubzmHGGCD2KDneDZY0jF0bTKojH 92YhY= X-Received: by 2002:a05:7300:1897:b0:30b:eb75:8a5a with SMTP id 5a478bee46e88-30bf09a16a4mr837136eec.25.1781746241535; Wed, 17 Jun 2026 18:30:41 -0700 (PDT) X-Received: by 2002:a05:7300:1897:b0:30b:eb75:8a5a with SMTP id 5a478bee46e88-30bf09a16a4mr837056eec.25.1781746239369; Wed, 17 Jun 2026 18:30:39 -0700 (PDT) Received: from [192.168.1.31] (c-24-130-122-79.hsd1.ca.comcast.net. [24.130.122.79]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3081e48e412sm26643423eec.4.2026.06.17.18.30.38 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 17 Jun 2026 18:30:38 -0700 (PDT) Message-ID: Date: Wed, 17 Jun 2026 18:30:37 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath6kl: fix use-after-free in aggr_reset_state() From: Jeff Johnson To: Daniel Hodges , linux-wireless@vger.kernel.org Cc: tglx@kernel.org, mingo@kernel.org, joe@perches.com, vthiagar@qca.qualcomm.com, rmani@qca.qualcomm.com, jouni@qca.qualcomm.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org References: <20260206185207.30098-1-git@danielhodges.dev> Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Proofpoint-ORIG-GUID: aK_MsKLngGFS6F03Ga6borbFyUDIvWGd X-Proofpoint-GUID: aK_MsKLngGFS6F03Ga6borbFyUDIvWGd X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjE4MDAxMSBTYWx0ZWRfX26IeMk1GWIDn rOlJ5FpCcfLsRsGVWeWbG6wEqkHxBMnoi4fQgcWKLhIWpRe5h1zjdxxGS6NEBWOw7iaaYQHxm/q +PtqgMofFBDlI++gOHarn5SWVq3Zef5CMcEXddDv0R+t7+YzQUdCPM7W/W6SunVk92Z9IxQ+Ood DD+jrJlTb+HZTM7ik7Kwsjuip1y0olKhlU4em6T4IWYmYeqch7/bQBdRY107d18uslxyTj5Qsqz lGbD5YjoAOyaaCU2ZP5FlEr+xDB+QMp1cBcAG2xQQBiKBl7a/jW1wT1hiKcPGRX2GMdcByeL+3m Oc/LYi6a78WCSJeoIGxo8uMlc3mHq48L7m4ixWa2idJgr/h0lilVAACHpLGDJ1wgNx6kw0vQJ3f cQNf2OrAPQDuF1SD+isiZLVxeW4c+Q4V+MepHzKE34mHi8lSISembo7AqSwgpa4s1V1TKCGfhf9 DShdyoxP+vpn93MaeOw== X-Proofpoint-Spam-Info: AW1haW4tMjYwNjE4MDAxMSBTYWx0ZWRfXzEYK+K/7j5to nALDpmxEzOSM8QOGavF4OEbQH2H2MnHJtO53T0AsGJ+3HI6HLTZEKQUTdf/rAvGIaplc1st4cOg GzZex4L7Qdt8u/VqRsVQGp348khRZ2M= X-Authority-Analysis: v=2.4 cv=YJKvDxGx c=1 sm=1 tr=0 ts=6a334a42 cx=c_pps a=wEP8DlPgTf/vqF+yE6f9lg==:117 a=Tg7Z00WN3eLgNEO9NLUKUQ==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=VwQbUJbxAAAA:8 a=ssj8URQz7FPryPeC8vIA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=bBxd6f-gb0O0v-kibOvt:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-17_02,2026-06-17_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 suspectscore=0 bulkscore=0 lowpriorityscore=0 spamscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606180011 On 6/17/2026 6:26 PM, Jeff Johnson wrote: > On 2/6/2026 10:52 AM, Daniel Hodges wrote: >> The aggr_reset_state() function uses timer_delete() (non-synchronous) >> for the aggregation timer before proceeding to delete TID state and >> before the structure is freed by callers like aggr_module_destroy(). >> >> If the timer callback (aggr_timeout) is executing when aggr_reset_state() >> is called, the callback will continue to access aggr_conn fields like >> rx_tid[] and stat[] which may be freed immediately after by >> kfree(aggr_info->aggr_conn) in aggr_module_destroy(). >> >> Additionally, the timer callback can re-arm itself via mod_timer() while >> aggr_reset_state() is running, creating a more complex race condition. >> >> Use timer_delete_sync() instead to ensure any running timer callback >> has completed before returning. >> >> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") >> Cc: stable@vger.kernel.org >> Signed-off-by: Daniel Hodges >> --- >> drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c >> index c3b06b515c4f..25ff5dec221c 100644 >> --- a/drivers/net/wireless/ath/ath6kl/txrx.c >> +++ b/drivers/net/wireless/ath/ath6kl/txrx.c >> @@ -1828,7 +1828,7 @@ void aggr_reset_state(struct aggr_info_conn *aggr_conn) >> return; >> >> if (aggr_conn->timer_scheduled) { >> - timer_delete(&aggr_conn->timer); >> + timer_delete_sync(&aggr_conn->timer); > > My review agent claims this still doesn't fix the UAF since aggr_timeout() can > call mod_timer() to rearm itself and hence the timer can fire again. > Instead it suggests timer_shutdown_sync() should be used since that prevents > any rearm from taking effect. > > But I'm not familiar with this driver so I don't know if there are reasons to > not use timer_shutdown_sync(), i.e. if the timer will be reused again then > timer_setup() will need to be called again. Interesting enough, another iteration of the same agent says: **The fix is correct.** `timer_delete_sync()` loops until the timer is both not-running and not-pending — it handles the re-arm case because after the callback calls `mod_timer()`, the sync loop picks that up and cancels it. Gotta love our new AI-driven workflows... /jeff