Re: [PATCH ath-next] ath9k: delete channel-context timers on deinit

[Toke Høiland-Jørgensen]

Rosen Penev <rosenp@xxxxxxxxx> writes:

> ath9k_deinit_channel_context() cancels chanctx_work but does not delete
> the offchannel and sched timers set up by ath9k_init_channel_context().
> If either timer fires after deinit (e.g. during driver unload or
> suspend), it accesses sc->sc_ah which may already be freed by
> ath9k_hw_deinit(), causing a use-after-free.
>
> Delete both timers with timer_delete_sync() before cancelling the work
> item.

>From the documentation of that function:

 * This function cannot guarantee that the timer is not rearmed again by
 * some concurrent or preempting code, right after it dropped the base
 * lock. If there is the possibility of a concurrent rearm then the return
 * value of the function is meaningless.
 *
 * If such a guarantee is needed, e.g. for teardown situations then use
 * timer_shutdown_sync() instead.

AFAICT, the timer callbacks can re-arm the timer, so this should be
using timer_shutdown_sync() instead.

-Toke