]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
authorMarek Szyprowski <m.szyprowski@samsung.com>
Thu, 16 Apr 2026 09:33:39 +0000 (11:33 +0200)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 27 Apr 2026 10:37:54 +0000 (12:37 +0200)
commitc623b63580880cc742255eaed3d79804c1b91143
tree9a8063a3513ea726aa627dcc137a45dd419e3a97
parent711a9c018ad252b2807f85d44e1267b595644f9b
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task

Watchdog task might end between send_sig() and kthread_stop() calls, what
results in the use-after-free issue. Fix this by increasing watchdog task
reference count before calling send_sig() and dropping it by switching to
kthread_stop_put().

Cc: stable@vger.kernel.org
Fixes: 373c83a801f1 ("brcmfmac: stop watchdog before detach and free everything")
Fixes: a9ffda88be74 ("brcm80211: fmac: abstract bus_stop interface function pointer")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260416093339.2066829-1-m.szyprowski@samsung.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c