diff options
| author | Martin Kaistra <martin.kaistra@linutronix.de> | 2024-01-11 19:36:27 +0300 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2024-03-27 01:16:31 +0300 |
| commit | 58fe3bbddfec10c6b216096d8c0e517cd8463e3a (patch) | |
| tree | 18cf76817a9b8ea24e37825c612ab9fa9a5abab8 /drivers | |
| parent | 9c68e3497b61f3ab849abe581f2712ab77c3c918 (diff) | |
| download | linux-58fe3bbddfec10c6b216096d8c0e517cd8463e3a.tar.xz | |
wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
[ Upstream commit 1213acb478a7181cd73eeaf00db430f1e45b1361 ]
The workqueue might still be running, when the driver is stopped. To
avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().
Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna")
Signed-off-by: Martin Kaistra <martin.kaistra@linutronix.de>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240111163628.320697-2-martin.kaistra@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c index 180907319e8c..04df0f54aa66 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -7304,6 +7304,7 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw) if (priv->usb_interrupts) rtl8xxxu_write32(priv, REG_USB_HIMR, 0); + cancel_work_sync(&priv->c2hcmd_work); cancel_delayed_work_sync(&priv->ra_watchdog); rtl8xxxu_free_rx_resources(priv); |