Re: [PATCH] wifi: brcmsmac: fix UAF in brcms_free_timer()

[Arend van Spriel]

On Sat, 15 Aug 2026 20:10:43 +0800, Jiangshan Yi wrote:
> brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous
> cancel_delayed_work() to cancel the timer's underlying delayed work.  If
> the work callback (_brcms_timer) is already running, cancel_delayed_work()
> returns false without waiting, and brcms_free_timer() proceeds to kfree(t)
> while the callback still accesses t through container_of().
>
> Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to
> guarantee that any in-flight callback has completed before the timer
> structure is freed.
>
> Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers")
> Cc: stable@xxxxxxxxxxxxxxx


Acked-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>

Regards,
Arend

> Signed-off-by: Jiangshan Yi <yijiangshan@xxxxxxxxxx>
> ---
>  .../net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c    | 4 ++++
>  1 file changed, 4 insertions(+)