Re: [PATCHv2 ath-next] wifi: ath9k: delete channel-context timers on deinit

[Toke Høiland-Jørgensen]

Rosen Penev <rosenp@xxxxxxxxx> writes:

> ath9k_deinit_channel_context() cancels chanctx_work but does not delete
> the offchannel and sched timers set up by ath9k_init_channel_context().
> If either timer fires after deinit (e.g. during driver unload or
> suspend), it accesses sc->sc_ah which may already be freed by
> ath9k_hw_deinit(), causing a use-after-free.
>
> Delete both timers with timer_shutdown_sync() before cancelling the work
> item.
>
> Assisted-by: LLM
> Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>

Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>