Tetsuo Handa <[email protected]> wrote: > syzbot is reporting that del_timer_sync() is called from > mwifiex_usb_cleanup_tx_aggr() from mwifiex_unregister_dev() without > checking timer_setup() from mwifiex_usb_tx_init() was called [1]. > > Ganapathi Bhat proposed a possibly cleaner fix, but it seems that > that fix was forgotten [2]. > > "grep -FrB1 'del_timer' drivers/ | grep -FA1 '.function)'" says that > currently there are 28 locations which call del_timer[_sync]() only if > that timer's function field was initialized (because timer_setup() sets > that timer's function field). Therefore, let's use same approach here. > > [1] > https://syzkaller.appspot.com/bug?id=26525f643f454dd7be0078423e3cdb0d57744959 > [2] > https://lkml.kernel.org/r/ca+asdxmht2gq9hy+ip_bykwxssrewdp3_bafmkncuqj3k+-...@mail.gmail.com > > Reported-by: syzbot <[email protected]> > Cc: Ganapathi Bhat <[email protected]> > Cc: Brian Norris <[email protected]> > Signed-off-by: Tetsuo Handa <[email protected]> > Reviewed-by: Brian Norris <[email protected]> > Acked-by: Ganapathi Bhat <[email protected]>
Patch applied to wireless-drivers-next.git, thanks. 621a3a8b1c0e mwifiex: don't call del_timer_sync() on uninitialized timer -- https://patchwork.kernel.org/patch/11728607/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
