Re: [PATCH] wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

[Loic Poulain]

On Thu, Sep 10, 2026 at 4:10 AM Fan Wu <fanwu01@xxxxxxxxxx> wrote:
>
> wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),
> which only dequeues the timer and does not wait for a callback that is
> already executing; the preceding free_irq() calls synchronize the
> interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can
> therefore be running past the teardown and use the wcn freed along
> with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock,
> reads wcn->tx_ack_skb and passes wcn->hw to
> ieee80211_tx_status_irqsafe().
>
> Fix this by using timer_shutdown_sync(), which waits for a running
> callback and also prevents the timer from being rearmed again. The
> timer is set up again by wcn36xx_dxe_init() on the next start, so the
> start/stop cycle is unaffected.
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: fdf21cc37149 ("wcn36xx: Add TX ack support")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Codex:gpt-5.6
> Co-developed-by: Song Li <songl@xxxxxxxxxx>
> Signed-off-by: Song Li <songl@xxxxxxxxxx>
> Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>

Reviewed-by: Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>

> ---
>  drivers/net/wireless/ath/wcn36xx/dxe.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
> index 44020ec26..801f1218e 100644
> --- a/drivers/net/wireless/ath/wcn36xx/dxe.c
> +++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
> @@ -1055,7 +1055,7 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
>
>         free_irq(wcn->tx_irq, wcn);
>         free_irq(wcn->rx_irq, wcn);
> -       timer_delete(&wcn->tx_ack_timer);
> +       timer_shutdown_sync(&wcn->tx_ack_timer);
>
>         if (wcn->tx_ack_skb) {
>                 ieee80211_tx_status_irqsafe(wcn->hw, wcn->tx_ack_skb);
>