Jiangshan Yi 1eeca1d5e0 wifi: brcmsmac: fix UAF in brcms_free_timer() ... brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of(). Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed. Fixes: 5b435de0d7 ("net: wireless: add brcm80211 drivers") Cc: stable@vger.kernel.org Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260815121043.938414-1-yijiangshan@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2026-09-15 11:52:56 +02:00
..
b43	wifi: b43, b43legacy: debugfs: use kzalloc() to allocate formatting buffers	2026-07-06 12:58:07 +02:00
b43legacy	wifi: b43, b43legacy: debugfs: use kzalloc() to allocate formatting buffers	2026-07-06 12:58:07 +02:00
brcm80211	wifi: brcmsmac: fix UAF in brcms_free_timer()	2026-09-15 11:52:56 +02:00
Kconfig
Makefile