wifi: nxpwifi: wait for the wakeup timer before the adapter is freed

Browse source

nxpwifi_adapter_cleanup() stops adapter->wakeup_timer with
timer_delete(), which does not wait for a running callback.  The
callback goes on using the adapter: wakeup_timer_fn() sets
adapter->hw_status, walks the command queues through
nxpwifi_cancel_all_pending_cmd() and calls adapter->if_ops.card_reset().
Both paths that reach nxpwifi_adapter_cleanup() free the adapter right
afterwards, through nxpwifi_free_adapter() in nxpwifi_remove_card() and
in the nxpwifi_add_card() error unwind.

Use timer_delete_sync() so the callback has finished before the adapter
is released.

mwifiex fixed the same issue in commit ae5e95d415 ("wifi: mwifiex: fix
use-after-free in mwifiex_adapter_cleanup()").

Fixes: 73b01e57ed ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>

...

This commit is contained in:

Linmao Li 2026-08-13 16:23:13 +08:00 • committed by Jeff Chen

parent 128411832c

commit 5c9260d7c6

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/net/wireless/nxp/nxpwifi/init.c

View file