[PATCH wireless] wifi: libertas_tf: use timer_delete_sync() in lbtf_remove_card()

[Tristan Madani]

lbtf_remove_card() uses timer_delete() for the command_timer.
timer_delete() only dequeues a pending timer without waiting for a
currently executing callback to finish.  If command_timer_fn() is
running on another CPU during card removal, it accesses priv->cur_cmd
and queues work on lbtf_wq while lbtf_remove_card() proceeds to free
the adapter, leading to a stale reference.

A prior fix addressed the same timer access issue in
lbtf_free_adapter() but missed the call in lbtf_remove_card().
Use timer_delete_sync() here
as well to ensure any in-progress timer callback completes before
proceeding with device teardown.

Fixes: 06b16ae53192 ("libertas_tf: main.c, data paths and mac80211 handlers")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
---
 drivers/net/wireless/marvell/libertas_tf/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/libertas_tf/main.c b/drivers/net/wireless/marvell/libertas_tf/main.c
index 411f075b6186a..f518ed48523e7 100644
--- a/drivers/net/wireless/marvell/libertas_tf/main.c
+++ b/drivers/net/wireless/marvell/libertas_tf/main.c
@@ -642,7 +642,7 @@ int lbtf_remove_card(struct lbtf_private *priv)
 	lbtf_deb_enter(LBTF_DEB_MAIN);
 
 	priv->surpriseremoved = 1;
-	timer_delete(&priv->command_timer);
+	timer_delete_sync(&priv->command_timer);
 	lbtf_free_adapter(priv);
 	priv->hw = NULL;
 	ieee80211_unregister_hw(hw);
-- 
2.47.3