wifi: iwlwifi: mvm: fix race condition in PTP removal

iwl_mvm_ptp_remove() calls cancel_delayed_work_sync() only after
ptp_clock_unregister() and clearing ptp_data state (ptp_clock,
ptp_clock_info, last_gp2).

This creates a race where the delayed work iwl_mvm_ptp_work() can
execute between ptp_clock_unregister() and cancel_delayed_work_sync(),
observing partially cleared PTP state.

Move cancel_delayed_work_sync() before ptp_clock_unregister() to
ensure the delayed work is fully stopped before any PTP cleanup
begins.

Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20260212125035.1345718-1-junjie.cao@intel.com
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
index f7b620136c8576a21ed4b7b7f8797e65afe27623..e05e531b09f0bfc95ff1aa467f24f327dc96dbed 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
@@ -325,11 +325,11 @@ void iwl_mvm_ptp_remove(struct iwl_mvm *mvm)
                               mvm->ptp_data.ptp_clock_info.name,
                               ptp_clock_index(mvm->ptp_data.ptp_clock));
 
+               cancel_delayed_work_sync(&mvm->ptp_data.dwork);
                ptp_clock_unregister(mvm->ptp_data.ptp_clock);
                mvm->ptp_data.ptp_clock = NULL;
                memset(&mvm->ptp_data.ptp_clock_info, 0,
                       sizeof(mvm->ptp_data.ptp_clock_info));
                mvm->ptp_data.last_gp2 = 0;
-               cancel_delayed_work_sync(&mvm->ptp_data.dwork);
        }
 }