linux/drivers/net/wireless/broadcom/brcm80211/brcmfmac
Marek Szyprowski c623b63580 wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
Watchdog task might end between send_sig() and kthread_stop() calls, what
results in the use-after-free issue. Fix this by increasing watchdog task
reference count before calling send_sig() and dropping it by switching to
kthread_stop_put().

Cc: stable@vger.kernel.org
Fixes: 373c83a801 ("brcmfmac: stop watchdog before detach and free everything")
Fixes: a9ffda88be ("brcm80211: fmac: abstract bus_stop interface function pointer")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260416093339.2066829-1-m.szyprowski@samsung.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:37:54 +02:00
..
bca Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cyw Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
wcc Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
acpi.c
bcdc.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
bcdc.h
bcmsdh.c Including fixes from IPsec, Bluetooth and netfilter 2026-02-26 08:00:13 -08:00
btcoex.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btcoex.h
bus.h
cfg80211.c wifi: cfg80211: support key installation on non-netdev wdevs 2026-03-02 11:28:33 +01:00
cfg80211.h wifi: brcmfmac: rename function that frees vif 2026-01-08 13:22:50 +01:00
chip.c wifi: brcmfmac: Fix error pointer dereference 2026-04-07 15:36:38 +02:00
chip.h
common.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
common.h wifi: Fix typos 2025-07-24 09:05:31 +02:00
commonring.c
commonring.h
core.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
core.h wifi: Fix typos 2025-07-24 09:05:31 +02:00
debug.c
debug.h
dmi.c wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet 2025-11-24 13:07:11 +01:00
feature.c wifi: brcmfmac: cyw: support external SAE authentication in station mode 2025-05-09 00:00:55 +02:00
feature.h wifi: brcmfmac: cyw: support external SAE authentication in station mode 2025-05-09 00:00:55 +02:00
firmware.c wifi: brcmfmac: silence warning for non-existent, optional firmware 2026-04-07 15:39:18 +02:00
firmware.h
flowring.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
flowring.h
fweh.c wifi: brcmfmac: validate bsscfg indices in IF events 2026-04-07 12:34:20 +02:00
fweh.h wifi: brcmfmac: cyw: support external SAE authentication in station mode 2025-05-09 00:00:55 +02:00
fwil_types.h
fwil.c
fwil.h
fwsignal.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
fwsignal.h
fwvid.c
fwvid.h wifi: brcmfmac: cyw: support external SAE authentication in station mode 2025-05-09 00:00:55 +02:00
Kconfig
Makefile
msgbuf.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
msgbuf.h
of.c wifi: brcmfmac: of: defer probe for MAC address 2026-04-07 15:37:09 +02:00
of.h
p2p.c wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode 2025-10-20 13:56:25 +02:00
p2p.h wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode 2025-10-20 13:56:25 +02:00
pcie.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
pcie.h
pno.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pno.h
proto.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
proto.h
sdio.c wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task 2026-04-27 12:37:54 +02:00
sdio.h wifi: brcmfmac: Fix potential kernel oops when probe fails 2026-02-23 09:24:30 +01:00
tracepoint.c
tracepoint.h
usb.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
usb.h
vendor.c
vendor.h
xtlv.c
xtlv.h