Re: [PATCH] tty: ipwireless: shut down setup timer before freeing hardware

[Greg Kroah-Hartman]

On Thu, Aug 06, 2026 at 02:07:40PM +0800, Hongyan Xu wrote:
> ipwireless_stop_interrupts() uses timer_delete() for a timer whose callback
> can rearm itself. timer_delete() neither waits for a running callback nor
> prevents that callback from rearming the timer. The callback can therefore
> continue to access struct ipw_hardware after ipwireless_hardware_free() has
> freed it.
> 
> Use timer_shutdown_sync() so teardown waits for the callback and prevents
> any further rearming.
> 
> Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hongyan Xu <getshell@xxxxxxxxxx>
> ---
>  drivers/tty/ipwireless/hardware.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
> index 0bfcbca6e2df..fb3554a6e04b 100644
> --- a/drivers/tty/ipwireless/hardware.c
> +++ b/drivers/tty/ipwireless/hardware.c
> @@ -1721,7 +1721,7 @@ void ipwireless_stop_interrupts(struct ipw_hardware *hw)
>  	if (!hw->shutting_down) {
>  		/* Tell everyone we are going down. */
>  		hw->shutting_down = 1;
> -		timer_delete(&hw->setup_timer);
> +		timer_shutdown_sync(&hw->setup_timer);
>  
>  		/* Prevent the hardware from sending any more interrupts */
>  		do_close_hardware(hw);
> -- 
> 2.50.1.windows.1
> 

How was this tested?