Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote: > syzbot is reporting that del_timer_sync() is called from > mwifiex_usb_cleanup_tx_aggr() from mwifiex_unregister_dev() without > checking timer_setup() from mwifiex_usb_tx_init() was called [1]. > > Ganapathi Bhat proposed a possibly cleaner fix, but it seems that > that fix was forgotten [2]. > > "grep -FrB1 'del_timer' drivers/ | grep -FA1 '.function)'" says that > currently there are 28 locations which call del_timer[_sync]() only if > that timer's function field was initialized (because timer_setup() sets > that timer's function field). Therefore, let's use same approach here. > > [1] https://syzkaller.appspot.com/bug?id=26525f643f454dd7be0078423e3cdb0d57744959 > [2] https://lkml.kernel.org/r/CA+ASDXMHt2gq9Hy+iP_BYkWXsSreWdp3_bAfMkNcuqJ3K+-jbQ@xxxxxxxxxxxxxx > > Reported-by: syzbot <syzbot+dc4127f950da51639216@xxxxxxxxxxxxxxxxxxxxxxxxx> > Cc: Ganapathi Bhat <ganapathi.bhat@xxxxxxx> > Cc: Brian Norris <briannorris@xxxxxxxxxxxx> > Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> > Reviewed-by: Brian Norris <briannorris@xxxxxxxxxxxx> > Acked-by: Ganapathi Bhat <ganapathi.bhat@xxxxxxx> Patch applied to wireless-drivers-next.git, thanks. 621a3a8b1c0e mwifiex: don't call del_timer_sync() on uninitialized timer -- https://patchwork.kernel.org/patch/11728607/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
