kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Daniel Hodges 03cc8f90d0 wifi: libertas: fix use-after-free in lbs_free_adapter() 
The lbs_free_adapter() function uses timer_delete() (non-synchronous)
for both command_timer and tx_lockup_timer before the structure is
freed. This is incorrect because timer_delete() does not wait for
any running timer callback to complete.

If a timer callback is executing when lbs_free_adapter() is called,
the callback will access freed memory since lbs_cfg_free() frees the
containing structure immediately after lbs_free_adapter() returns.

Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)
access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,
which would all be use-after-free violations.

Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.

This bug was introduced in commit 8f641d93c3 ("libertas: detect TX
lockups and reset hardware") where del_timer() was used instead of
del_timer_sync() in the cleanup path. The command_timer has had the
same issue since the driver was first written.

Fixes: 8f641d93c3 ("libertas: detect TX lockups and reset hardware")
Fixes: 954ee164f4 ("[PATCH] libertas: reorganize and simplify init sequence")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
History 2026-02-23 09:28:14 +01:00
..
accel Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
accessibility treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
acpi More ACPI support updates for 7.0-rc1 2026-02-18 14:28:57 -08:00
amba soc: driver updates for 6.19 2025-12-05 17:29:04 -08:00
android Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
ata ATA changes for 6.20 2026-02-12 17:12:43 -08:00
atm Including fixes from Netfilter. 2026-02-19 10:39:08 -08:00
auxdisplay mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
base More power management updates for 7.0-rc1 2026-02-18 14:11:47 -08:00
bcma bcma: don't register devices disabled in OF 2025-10-20 13:54:15 +02:00
block block-7.0-20260216 2026-02-17 08:48:45 -08:00
bluetooth TTY / Serial driver updates for 7.0-rc1 2026-02-17 09:30:52 -08:00
bus Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
cache cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent 2025-11-21 18:42:02 +00:00
cdrom cdrom: Call cdrom_mrw_exit from cdrom_release function 2025-07-22 19:10:17 -06:00
cdx cdx: Use mutex guard to simplify error handling 2026-02-03 20:58:13 -06:00
char mm.git review status for linus..mm-stable 2026-02-18 20:50:32 -08:00
clk cleanups and fixes 2026-02-16 09:30:44 -08:00
clocksource - A nice cleanup to the paravirt code containing a unification of the paravirt 2026-02-10 19:01:45 -08:00
comedi Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter counter: 104-quad-8: Fix incorrect return value in IRQ handler 2025-12-22 20:03:23 +09:00
cpufreq Devicetree updates for v7.0: 2026-02-11 18:27:08 -08:00
cpuidle More power management updates for 7.0-rc1 2026-02-18 14:11:47 -08:00
crypto platform-drivers-x86 for v7.0-1 2026-02-13 15:39:15 -08:00
cxl cxl changes for v7.0 2026-02-12 16:33:05 -08:00
dax mm.git review status for linus..mm-stable 2026-02-18 20:50:32 -08:00
dca Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
devfreq PM / devfreq: Fix typo in DFSO_DOWNDIFFERENTIAL macro name 2025-11-26 13:58:59 +09:00
dibs dibs: Remove KMSG_COMPONENT macro 2025-11-27 18:11:43 -08:00
dio dio: Have dio_bus_match() callback take a const * 2024-07-10 15:38:14 +02:00
dma dmaengine updates for v7.0 2026-02-17 11:47:17 -08:00
dma-buf VFIO updates for v7.0-rc1 2026-02-12 15:52:39 -08:00
dpll dpll: zl3073x: Fix ref frequency setting 2026-02-17 17:06:51 -08:00
edac - Remove two drivers for obsolete hardware: i82443bxgx_edac and r82600_edac 2026-02-10 18:14:36 -08:00
eisa drivers: eisa: make eisa_bus_type const 2025-10-22 07:55:00 +02:00
extcon extcon: max14526: depends on I2C to prevent build warning/errors 2025-09-08 15:13:06 +09:00
firewire SCSI misc on 20260212 2026-02-12 15:43:02 -08:00
firmware Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
fpga fpga: dfl: fix typo in header file 2026-01-22 17:08:06 +08:00
fsi fsi: scom: Convert to fsi bus probe mechanism 2026-01-27 16:35:36 +01:00
fwctl pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc 2025-09-22 10:33:10 -03:00
gnss gnss: ubx: add support for the safeboot gpio 2025-11-20 16:44:04 +01:00
gpib gpib: tnt4882: Unify *allocate_private usage 2026-01-27 16:04:08 +01:00
gpio virtio,vhost,vdpa: features, fixes 2026-02-13 12:02:18 -08:00
gpu mm.git review status for linus..mm-stable 2026-02-18 20:50:32 -08:00
greybus greybus: Use bus methods for .probe() and .remove() 2026-01-16 16:32:03 +01:00
hid Input updates for v7.0-rc0 2026-02-15 08:24:19 -08:00
hsi HSI: omap_ssi_port: Remove redundant pm_runtime_mark_last_busy() calls 2025-09-05 22:56:59 +02:00
hte treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
hv drivers: hv: vmbus_drv: Remove reference to hpyerv_fb 2026-02-14 11:07:12 +01:00
hwmon mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
hwspinlock soc: driver updates for 7.0 2026-02-10 20:45:30 -08:00
hwtracing Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
i2c Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
i3c i3c: dw-i3c-master: fix SIR reject bit mapping for dynamic addresses 2026-01-31 00:05:22 +01:00
idle intel_idle: Add C-states validation 2026-01-07 21:17:43 +01:00
iio IIO: New device support, features and cleanup for the 6.20/7.0 cycle. 2026-02-02 17:08:30 +01:00
infiniband RDMA v7.0 merge window 2026-02-12 17:05:20 -08:00
input Input updates for v7.0-rc0 2026-02-15 08:24:19 -08:00
interconnect interconnect changes for 6.20 2026-01-30 16:46:45 +01:00
iommu RISC-V updates for v7.0 2026-02-12 19:17:44 -08:00
ipack driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
irqchip cleanups and fixes 2026-02-16 09:30:44 -08:00
isdn mISDN: annotate data-race around dev->work 2026-01-20 18:37:41 -08:00
leds LEDS for v6.20 2026-02-16 11:15:19 -08:00
macintosh soc: driver updates for 6.19 2025-12-05 17:29:04 -08:00
mailbox soc: driver updates for 7.0 2026-02-10 20:45:30 -08:00
mcb mcb: fix incorrect sanity check 2026-01-27 15:54:09 +01:00
md block-7.0-20260216 2026-02-17 08:48:45 -08:00
media mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
memory memory: mtk-smi: clean up device link creation 2025-12-16 08:21:11 +01:00
memstick Summary of significant series in this pull request: 2025-10-02 18:18:33 -07:00
message scsi: Change the return type of the .queuecommand() callback 2026-01-23 21:32:34 -05:00
mfd MFD for v6.20 2026-02-16 11:05:44 -08:00
misc Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
mmc cleanups and fixes 2026-02-16 09:30:44 -08:00
most most: core: fix leak on early registration failure 2026-01-27 15:53:30 +01:00
mtd * MTD 2026-02-13 15:06:58 -08:00
mux mux: mmio: fix regmap leak on probe failure 2026-02-05 17:07:37 +01:00
net wifi: libertas: fix use-after-free in lbs_free_adapter() 2026-02-23 09:28:14 +01:00
nfc nfc: nxp-nci: remove interrupt trigger type 2026-02-06 20:54:50 -08:00
ntb ntb: transport: Fix uninitialized mutex 2026-01-17 11:57:39 -05:00
nubus nubus: Call put_device() in bus initialization error path 2026-01-26 12:26:01 +01:00
nvdimm nvdimm: virtio_pmem: serialize flush requests 2026-02-04 13:16:40 -06:00
nvme block-7.0-20260216 2026-02-17 08:48:45 -08:00
nvmem Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
of mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
opp OPP: Return correct value in dev_pm_opp_get_level 2026-01-27 10:58:50 +05:30
parisc parisc architecture fixes and updates for kernel v7.0-rc1: 2026-02-10 21:42:10 -08:00
parport treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
pci cxl changes for v7.0 2026-02-12 16:33:05 -08:00
pcmcia PCI: Separate CardBus setup & build it only with CONFIG_CARDBUS 2026-01-27 16:36:52 -06:00
peci Char/Misc/IIO driver updates for 6.19-rc1 2025-12-06 18:34:24 -08:00
perf perf/arm-cmn: Reject unsupported hardware configurations 2026-02-03 19:43:52 +00:00
phy phy-for-7.0 2026-02-17 11:40:04 -08:00
pinctrl Pin control changes for the v7.0 kernel cycle: 2026-02-16 09:35:24 -08:00
platform USB / Thunderbolt changes for 7.0-rc1 2026-02-17 09:36:43 -08:00
pmdomain pmdomain providers: 2026-02-06 10:10:39 -08:00
pnp kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
power power supply and reset changes for the 7.0 series 2026-02-12 18:24:37 -08:00
powercap powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check 2026-02-12 14:49:14 +01:00
pps pps: generators: remove broken pps_gen_parport driver 2026-01-27 15:54:27 +01:00
ps3 powerpc/ps3: Use str_write_read() in ps3stor_read_write_sectors() 2025-09-06 17:01:26 +05:30
ptp mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
pwm Driver core changes for 7.0-rc1 2026-02-11 17:43:59 -08:00
rapidio rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() 2026-01-31 16:16:07 -08:00
ras - Remove two drivers for obsolete hardware: i82443bxgx_edac and r82600_edac 2026-02-10 18:14:36 -08:00
regulator MFD for v6.20 2026-02-16 11:05:44 -08:00
remoteproc remoteproc: imx_rproc: Fix invalid loaded resource table detection 2026-02-03 09:23:12 -07:00
resctrl arm_mpam: Use non-atomic bitops when modifying feature bitmap 2026-01-16 12:04:20 +00:00
reset reset: spacemit: Add SpacemiT K3 reset driver 2026-01-24 16:53:02 +01:00
rpmsg rpmsg: core: fix race in driver_override_show() and use core helper 2025-12-14 18:37:49 -07:00
rtc cleanups and fixes 2026-02-16 09:30:44 -08:00
s390 SCSI misc on 20260212 2026-02-12 15:43:02 -08:00
sbus Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
scsi virtio,vhost,vdpa: features, fixes 2026-02-13 12:02:18 -08:00
sh syscore: Pass context data to callbacks 2025-11-14 10:01:52 +01:00
siox siox: bus-gpio: Remove the use of dev_err_probe() 2025-09-06 15:59:59 +02:00
slimbus slimbus: qcom-ngd: Simplify with scoped for each OF child loop 2026-01-27 15:53:49 +01:00
soc phy-for-7.0 2026-02-17 11:40:04 -08:00
soundwire soundwire updates for 7.0 2026-02-17 10:07:13 -08:00
spi Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
spmi spmi: spmi-pmic-arb: add support for PMIC arbiter v8 2026-01-23 19:24:39 +01:00
ssb treewide: rename GPIO set callbacks back to their original names 2025-08-07 10:07:06 +02:00
staging Staging driver updates for 7.0-rc1 2026-02-17 09:20:58 -08:00
target SCSI misc on 20260212 2026-02-12 15:43:02 -08:00
tc TC: Fix the wrong format specifier 2024-11-12 15:48:08 +01:00
tee TEE sysfs for 6.20 2026-01-21 16:30:52 +01:00
thermal Additional thermal control update for 7.0-rc1 2026-02-18 14:33:18 -08:00
thunderbolt USB / Thunderbolt changes for 7.0-rc1 2026-02-17 09:36:43 -08:00
tty TTY / Serial driver updates for 7.0-rc1 2026-02-17 09:30:52 -08:00
ufs SCSI misc on 20260212 2026-02-12 15:43:02 -08:00
uio uio: pci_sva: correct '-ENODEV' check logic 2026-01-16 16:43:43 +01:00
usb USB / Thunderbolt changes for 7.0-rc1 2026-02-17 09:36:43 -08:00
vdpa vduse: avoid adding implicit padding 2026-02-09 12:21:32 -05:00
vfio VFIO updates for v7.0-rc1 2026-02-12 15:52:39 -08:00
vhost virtio,vhost,vdpa: features, fixes 2026-02-13 12:02:18 -08:00
video Backlight for v6.20 2026-02-16 11:10:33 -08:00
virt tsm for 7.0 2026-02-15 10:20:37 -08:00
virtio virtio,vhost,vdpa: features, fixes 2026-02-13 12:02:18 -08:00
w1 w1: fix redundant counter decrement in w1_attach_slave_device() 2025-12-28 11:52:10 +01:00
watchdog linux-watchdog 6.20-rc1 tag 2026-02-16 12:21:22 -08:00
xen - A nice cleanup to the paravirt code containing a unification of the paravirt 2026-02-10 19:01:45 -08:00
zorro zorro: Remove extra whitespace in macro definitions 2025-09-15 14:30:17 +02:00
Kconfig Staging driver updates for 6.19-rc1 2025-12-06 18:52:00 -08:00
Makefile phy: enter drivers/phy/Makefile even without CONFIG_GENERIC_PHY 2026-02-04 20:45:26 +05:30