Commit 1801a942 authored by Miri Korenblit's avatar Miri Korenblit Committed by Johannes Berg
Browse files

wifi: iwlwifi: trans: cancel restart work on op mode leave 



If the restart work happens to run after the opmode left
(i.e. called iwl_trans_op_mode_leave), then the opmode memory (including
its mutex) is likely to be freed already, and trans->opmode is NULL.

Although the hw is stopped in that stage, which means that this restart
got aborted (i.e. STATUS_RESET_PENDING will be cleared),
it still can access trans->opmode (NULL pointer dereference)
or the opmodes memory (which is freed).

Fix this by canceling the restart wk in iwl_trans_op_mode_leave.
Also make sure that the restart wk is really aborted.

Fixes: 7391b2a4 ("wifi: iwlwifi: rework firmware error handling")
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-by: default avatarJohannes Berg <johannes.berg@intel.com>
Link: https://patch.msgid.link/20250306122425.801301ba1b8b.I6f6143f550b6335b699920c5d4b2b78449607a96@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent b8c8a03e

drivers/net/wireless/intel/iwlwifi/iwl-trans.c

+2 −0
Original line number Diff line number Diff line
@@ -403,6 +403,8 @@ void iwl_trans_op_mode_leave(struct iwl_trans *trans) 


	iwl_trans_pcie_op_mode_leave(trans);



	cancel_work_sync(&trans->restart.wk);



	trans->op_mode = NULL;



	trans->state = IWL_TRANS_NO_FW;