netdev - [PATCH] wifi: iwlwifi: ptp: Fix potential race condition in PTP removal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260115161529.85720-1-junjie.cao@intel.com>
Date: Fri, 16 Jan 2026 00:15:29 +0800
From: Junjie Cao <junjie.cao@...el.com>
To: Miri Korenblit <miriam.rachel.korenblit@...el.com>,
	Johannes Berg <johannes.berg@...el.com>,
	linux-wireless@...r.kernel.org,
	Richard Cochran <richardcochran@...il.com>
Cc: Simon Horman <horms@...nel.org>,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Yedidya Benshimol <yedidya.ben.shimol@...el.com>,
	Avraham Stern <avraham.stern@...el.com>,
	Daniel Gabay <daniel.gabay@...el.com>,
	Krishnanand Prabhu <krishnanand.prabhu@...el.com>,
	Luca Coelho <luciano.coelho@...el.com>,
	Gregory Greenman <gregory.greenman@...el.com>,
	stable@...r.kernel.org
Subject: [PATCH] wifi: iwlwifi: ptp: Fix potential race condition in PTP removal

iwl_mvm_ptp_remove() and iwl_mld_ptp_remove() call
cancel_delayed_work_sync() only after ptp_clock_unregister() and after
partially clearing ptp_data state.

This creates a race where the delayed work (iwl_mvm_ptp_work /
iwl_mld_ptp_work) can run while teardown is in progress and observe a
partially modified PTP state. In addition, the work may re-arm itself,
extending the teardown window and risking execution after driver
resources have been released.

Move cancel_delayed_work_sync() before ptp_clock_unregister() to ensure
the delayed work is fully stopped before any PTP cleanup begins. This
follows the standard pattern used by other Intel PTP drivers such as
e1000e, igb, ixgbe, and ice.

Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Fixes: 1595ecce1cf3 ("wifi: iwlwifi: mvm: add support for PTP HW clock (PHC)")
Cc: stable@...r.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@...el.com>
---
 drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
index 231920425c06..b40182320801 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
@@ -319,10 +319,10 @@ void iwl_mld_ptp_remove(struct iwl_mld *mld)
 			       mld->ptp_data.ptp_clock_info.name,
 			       ptp_clock_index(mld->ptp_data.ptp_clock));
 
+		cancel_delayed_work_sync(&mld->ptp_data.dwork);
 		ptp_clock_unregister(mld->ptp_data.ptp_clock);
 		mld->ptp_data.ptp_clock = NULL;
 		mld->ptp_data.last_gp2 = 0;
 		mld->ptp_data.wrap_counter = 0;
-		cancel_delayed_work_sync(&mld->ptp_data.dwork);
 	}
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
index 1da6260e238c..2b01ca36a1b5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
@@ -325,11 +325,11 @@ void iwl_mvm_ptp_remove(struct iwl_mvm *mvm)
 			       mvm->ptp_data.ptp_clock_info.name,
 			       ptp_clock_index(mvm->ptp_data.ptp_clock));
 
+		cancel_delayed_work_sync(&mvm->ptp_data.dwork);
 		ptp_clock_unregister(mvm->ptp_data.ptp_clock);
 		mvm->ptp_data.ptp_clock = NULL;
 		memset(&mvm->ptp_data.ptp_clock_info, 0,
 		       sizeof(mvm->ptp_data.ptp_clock_info));
 		mvm->ptp_data.last_gp2 = 0;
-		cancel_delayed_work_sync(&mvm->ptp_data.dwork);
 	}
 }
-- 
2.43.0