lbtf_remove_card() uses timer_delete() for the command_timer. timer_delete() only dequeues a pending timer without waiting for a currently executing callback to finish. If command_timer_fn() is running on another CPU during card removal, it accesses priv->cur_cmd and queues work on lbtf_wq while lbtf_remove_card() proceeds to free the adapter, leading to a stale reference. A prior fix addressed the same timer access issue in lbtf_free_adapter() but missed the call in lbtf_remove_card(). Use timer_delete_sync() here as well to ensure any in-progress timer callback completes before proceeding with device teardown. Fixes: 06b16ae53192 ("libertas_tf: main.c, data paths and mac80211 handlers") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/marvell/libertas_tf/main.c b/drivers/net/wireless/marvell/libertas_tf/main.c index 411f075b6186a..f518ed48523e7 100644 --- a/drivers/net/wireless/marvell/libertas_tf/main.c +++ b/drivers/net/wireless/marvell/libertas_tf/main.c @@ -642,7 +642,7 @@ int lbtf_remove_card(struct lbtf_private *priv) lbtf_deb_enter(LBTF_DEB_MAIN); priv->surpriseremoved = 1; - timer_delete(&priv->command_timer); + timer_delete_sync(&priv->command_timer); lbtf_free_adapter(priv); priv->hw = NULL; ieee80211_unregister_hw(hw); -- 2.47.3