Marek SzyprowskiandGreg Kroah-Hartman d616bb10de wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task ...

[ Upstream commit c623b63580 ]

Watchdog task might end between send_sig() and kthread_stop() calls, what
results in the use-after-free issue. Fix this by increasing watchdog task
reference count before calling send_sig() and dropping it by switching to
kthread_stop_put().

Cc: stable@vger.kernel.org
Fixes: 373c83a801 ("brcmfmac: stop watchdog before detach and free everything")
Fixes: a9ffda88be ("brcm80211: fmac: abstract bus_stop interface function pointer")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260416093339.2066829-1-m.szyprowski@samsung.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ replaced kthread_stop_put() with open-coded kthread_stop() + put_task_struct() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-06-19 13:37:21 +02:00

..

b43

wifi: b43: enforce bounds check on firmware key index in b43_rx()

2026-06-01 17:38:54 +02:00

b43legacy

wifi: b43legacy: enforce bounds check on firmware key index in RX path

2026-06-01 17:38:54 +02:00

brcm80211

wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task

2026-06-19 13:37:21 +02:00

Kconfig

…

Makefile

…