[PATCH wireless] wifi: mwifiex: cancel DFS delayed works before destroying workqueues

[Tristan Madani]

mwifiex_del_virtual_intf() and the error path of
mwifiex_add_virtual_intf() destroy dfs_cac_workqueue and
dfs_chan_sw_workqueue without first cancelling the associated
delayed works. Since destroy_workqueue() does not cancel pending
delayed work timers, a timer that fires after the workqueue is
destroyed runs against freed memory.

Add cancel_delayed_work_sync() for dfs_cac_work and
dfs_chan_sw_work before each destroy_workqueue() call in both the
error cleanup and interface removal paths.

Fixes: 85afb18621be ("mwifiex: add cfg80211 start_radar_detection handler")
Fixes: 7d652034d1a0 ("mwifiex: channel switch support for mwifiex")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 936939ea9c472..1fe366b89a2c2 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -3196,9 +3196,11 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 	return &priv->wdev;
 
 err_reg_netdev:
+	cancel_delayed_work_sync(&priv->dfs_chan_sw_work);
 	destroy_workqueue(priv->dfs_chan_sw_workqueue);
 	priv->dfs_chan_sw_workqueue = NULL;
 err_alloc_chsw:
+	cancel_delayed_work_sync(&priv->dfs_cac_work);
 	destroy_workqueue(priv->dfs_cac_workqueue);
 	priv->dfs_cac_workqueue = NULL;
 err_alloc_cac:
@@ -3245,11 +3247,13 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 		cfg80211_unregister_netdevice(wdev->netdev);
 
 	if (priv->dfs_cac_workqueue) {
+		cancel_delayed_work_sync(&priv->dfs_cac_work);
 		destroy_workqueue(priv->dfs_cac_workqueue);
 		priv->dfs_cac_workqueue = NULL;
 	}
 
 	if (priv->dfs_chan_sw_workqueue) {
+		cancel_delayed_work_sync(&priv->dfs_chan_sw_work);
 		destroy_workqueue(priv->dfs_chan_sw_workqueue);
 		priv->dfs_chan_sw_workqueue = NULL;
 	}
-- 
2.47.3