The throughput (tpt) LED trigger timer is only stopped in ieee80211_stop_tpt_led_trig(), which is reached via ieee80211_stop_device() when the interface is brought down. On a hot unplug, the device is torn down through ieee80211_unregister_hw() without ever going through ieee80211_do_stop(), so the timer is never stopped. ieee80211_led_exit() then frees local->tpt_led_trigger (which embeds the timer) without cancelling it. The still-armed timer keeps firing and dereferences the freed tpt_trig, walking local->tpt_led's LED list in led_trigger_blink() -> led_blink_set_nosleep() on the freed wifi LED class device, causing a use-after-free page fault in interrupt context. Call ieee80211_stop_tpt_led_trig() in ieee80211_led_exit(), before unregistering the trigger and freeing the struct, so the timer is always stopped and can never run after the trigger/LEDs are torn down. Fixes: e1e540685437 ("mac80211: add throughput based LED blink trigger") Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev --- net/mac80211/led.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/mac80211/led.c b/net/mac80211/led.c index b5600d223452..5a7747dfbfb1 100644 --- a/net/mac80211/led.c +++ b/net/mac80211/led.c @@ -9,6 +9,8 @@ #include #include "led.h" +static void ieee80211_stop_tpt_led_trig(struct ieee80211_local *local); + void ieee80211_led_assoc(struct ieee80211_local *local, bool associated) { if (!atomic_read(&local->assoc_led_active)) @@ -206,6 +208,7 @@ void ieee80211_led_exit(struct ieee80211_local *local) led_trigger_unregister(&local->rx_led); if (local->tpt_led_trigger) { + ieee80211_stop_tpt_led_trig(local); led_trigger_unregister(&local->tpt_led); kfree(local->tpt_led_trigger); } -- 2.55.0