wifi: iwlwifi: mld: fix race condition in PTP removal

iwl_mld_ptp_remove() calls cancel_delayed_work_sync() only after
ptp_clock_unregister() and clearing ptp_data state (ptp_clock,
last_gp2, wrap_counter).

This creates a race where the delayed work iwl_mld_ptp_work() can
execute between ptp_clock_unregister() and cancel_delayed_work_sync(),
observing partially cleared PTP state.

Move cancel_delayed_work_sync() before ptp_clock_unregister() to
ensure the delayed work is fully stopped before any PTP cleanup
begins.

Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20260212125035.1345718-2-junjie.cao@intel.com
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
index c65f4b56a3270f61533210a867da17d08a609440..20ae338e5696d7904b6afe78a312cbe41408ce2b 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
@@ -321,10 +321,10 @@ void iwl_mld_ptp_remove(struct iwl_mld *mld)
                               mld->ptp_data.ptp_clock_info.name,
                               ptp_clock_index(mld->ptp_data.ptp_clock));
 
+               cancel_delayed_work_sync(&mld->ptp_data.dwork);
                ptp_clock_unregister(mld->ptp_data.ptp_clock);
                mld->ptp_data.ptp_clock = NULL;
                mld->ptp_data.last_gp2 = 0;
                mld->ptp_data.wrap_counter = 0;
-               cancel_delayed_work_sync(&mld->ptp_data.dwork);
        }
 }