Re: [PATCH] wifi: ath6kl: fix use-after-free in aggr_reset_state()

[Jeff Johnson]

On Fri, 06 Feb 2026 13:52:07 -0500, Daniel Hodges wrote:
> The aggr_reset_state() function uses timer_delete() (non-synchronous)
> for the aggregation timer before proceeding to delete TID state and
> before the structure is freed by callers like aggr_module_destroy().
> 
> If the timer callback (aggr_timeout) is executing when aggr_reset_state()
> is called, the callback will continue to access aggr_conn fields like
> rx_tid[] and stat[] which may be freed immediately after by
> kfree(aggr_info->aggr_conn) in aggr_module_destroy().
> 
> [...]

Applied, thanks!

[1/1] wifi: ath6kl: fix use-after-free in aggr_reset_state()
      commit: ba7debb4dd6427386862220e8335a53a4bfc235d

Best regards,
-- 
Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx>