Miri Korenblit dea22de162 wifi: cfg80211: cancel wiphy_work before freeing wiphy ...

[ Upstream commit 72d520476a ]

A wiphy_work can be queued from the moment the wiphy is allocated and
initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the
rdev::wiphy_work is getting queued.

If wiphy_free is called before the rdev::wiphy_work had a chance to run,
the wiphy memory will be freed, and then when it eventally gets to run
it'll use invalid memory.

Fix this by canceling the work before freeing the wiphy.

Fixes: a3ee4dc84c ("wifi: cfg80211: add a work abstraction with special semantics")
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Link: https://patch.msgid.link/20250306123626.efd1d19f6e07.I48229f96f4067ef73f5b87302335e2fd750136c9@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-03-22 12:56:41 -07:00

..

certs

wifi: cfg80211: fix certs build to not depend on file order

2023-12-14 09:11:51 +01:00

tests

wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap()

2025-02-08 10:01:07 +01:00

.gitignore

.gitignore: add SPDX License Identifier

2020-03-25 11:50:48 +01:00

ap.c

wifi: cfg80211: remove wdev mutex

2023-09-11 11:27:23 +02:00

chan.c

wifi: cfg80211: pass net_device to .set_monitor_channel

2024-10-23 16:45:35 +02:00

core.c

wifi: cfg80211: cancel wiphy_work before freeing wiphy

2025-03-22 12:56:41 -07:00

core.h

wifi: cfg80211: pass net_device to .set_monitor_channel

2024-10-23 16:45:35 +02:00

debugfs.c

wifi: cfg80211: add locked debugfs wrappers

2023-11-27 11:24:58 +01:00

debugfs.h

…

ethtool.c

wifi: cfg80211: use strscpy to replace strlcpy

2022-07-15 11:43:12 +02:00

ibss.c

wifi: cfg80211: move DFS related members to links[] in wireless_dev

2024-09-06 13:01:05 +02:00

Kconfig

wifi: cfg80211: stop exporting wext symbols

2024-10-08 21:53:31 +02:00

Makefile

wifi: wext/libipw: move spy implementation to libipw

2024-10-08 21:53:18 +02:00

mesh.c

wifi: cfg80211: move DFS related members to links[] in wireless_dev

2024-09-06 13:01:05 +02:00

mlme.c

wifi: cfg80211: Remove the Medium Synchronization Delay validity check

2024-11-07 14:38:18 +01:00

nl80211.c

wifi: nl80211: reject cooked mode if it is set along with other flags

2025-03-13 13:07:47 +01:00

nl80211.h

wifi: nl80211: clean up coalescing rule handling

2024-05-29 10:38:53 +02:00

ocb.c

wifi: cfg80211: remove wdev mutex

2023-09-11 11:27:23 +02:00

of.c

…

pmsr.c

wifi: nl80211: remove the FTMs per burst limit for NDP ranging

2024-06-12 13:04:25 +02:00

radiotap.c

Merge net-next/main to resolve conflicts

2024-10-09 08:59:22 +02:00

rdev-ops.h

wifi: cfg80211: pass net_device to .set_monitor_channel

2024-10-23 16:45:35 +02:00

reg.c

wifi: cfg80211: regulatory: improve invalid hints checking

2025-03-13 13:07:47 +01:00

reg.h

wifi: cfg80211: add return docs for regulatory functions

2024-04-19 10:29:08 +02:00

scan.c

wifi: cfg80211: adjust allocation of colocated AP data

2025-02-08 10:01:25 +01:00

sme.c

wifi: cfg80211: sme: init n_channels before channels[] access

2024-12-06 10:45:22 +01:00

sysfs.c

wifi: cfg80211: fully move wiphy work to unbound workqueue

2024-05-29 15:23:33 +02:00

sysfs.h

…

trace.c

…

trace.h

wifi: cfg80211: pass net_device to .set_monitor_channel

2024-10-23 16:45:35 +02:00

util.c

wifi: cfg80211: clear link ID from bitmap during link delete after clean up

2024-12-03 11:28:20 +01:00

wext-compat.c

wifi: cfg80211: pass net_device to .set_monitor_channel

2024-10-23 16:45:35 +02:00

wext-compat.h

Revert "wifi: cfg80211: unexport wireless_nlevent_flush()"

2024-10-09 08:53:01 +02:00

wext-core.c

Revert "wifi: cfg80211: unexport wireless_nlevent_flush()"

2024-10-09 08:53:01 +02:00

wext-priv.c

…

wext-proc.c

proc: introduce proc_create_net{,_data}

2018-05-16 07:24:30 +02:00

wext-sme.c

wifi: cfg80211: remove wdev mutex

2023-09-11 11:27:23 +02:00