Messages in this thread | | | Subject | Re: [PATCH v2] mwifiex: don't call del_timer_sync() on uninitialized timer | From | Kalle Valo <> | Date | Thu, 27 Aug 2020 10:00:06 +0000 (UTC) |
| |
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> wrote:
> syzbot is reporting that del_timer_sync() is called from > mwifiex_usb_cleanup_tx_aggr() from mwifiex_unregister_dev() without > checking timer_setup() from mwifiex_usb_tx_init() was called [1]. > > Ganapathi Bhat proposed a possibly cleaner fix, but it seems that > that fix was forgotten [2]. > > "grep -FrB1 'del_timer' drivers/ | grep -FA1 '.function)'" says that > currently there are 28 locations which call del_timer[_sync]() only if > that timer's function field was initialized (because timer_setup() sets > that timer's function field). Therefore, let's use same approach here. > > [1] https://syzkaller.appspot.com/bug?id=26525f643f454dd7be0078423e3cdb0d57744959 > [2] https://lkml.kernel.org/r/CA+ASDXMHt2gq9Hy+iP_BYkWXsSreWdp3_bAfMkNcuqJ3K+-jbQ@mail.gmail.com > > Reported-by: syzbot <syzbot+dc4127f950da51639216@syzkaller.appspotmail.com> > Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com> > Cc: Brian Norris <briannorris@chromium.org> > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > Reviewed-by: Brian Norris <briannorris@chromium.org> > Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
Patch applied to wireless-drivers-next.git, thanks.
621a3a8b1c0e mwifiex: don't call del_timer_sync() on uninitialized timer
-- https://patchwork.kernel.org/patch/11728607/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
| |