Jiangshan Yi bbb9a0ab96 wifi: libertas_tf: fix UAF in lbtf_free_adapter() ... lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer callback. If the timer callback (command_timer_fn) is already running when lbtf_free_cmd_buffer() frees the command array, the callback dereferences priv->cur_cmd->cmdbuf which points to freed memory. Swap the order so that timer_delete_sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed. Fixes: 06b16ae531 ("libertas_tf: main.c, data paths and mac80211 handlers") Cc: stable@vger.kernel.org Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn> Link: https://patch.msgid.link/20260815115724.920628-1-yijiangshan@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2026-09-04 10:08:15 +02:00
..
cmd.c	treewide: Switch/rename to timer_delete[_sync]()	2025-04-05 10:30:12 +02:00
deb_defs.h	net: libertas libertas_tf: Remove in_interrupt() from debug macro.	2020-09-29 14:02:55 -07:00
if_usb.c	wifi: libertas_tf: refactor endpoint lookup	2026-04-08 08:33:40 +02:00
if_usb.h	wireless: marvell: Replace zero-length array with flexible-array member	2020-03-23 19:11:09 +02:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
libertas_tf.h	wifi: libertas: Cleanup unused declarations	2024-09-09 15:30:26 +03:00
main.c	wifi: libertas_tf: fix UAF in lbtf_free_adapter()	2026-09-04 10:08:15 +02:00
Makefile