Steven Rostedt [off-list ref] writes:

[
  Linus,

    I ran the script against your latest master branch:
    commit b6bb9676f2165d518b35ba3bea5f1fcfc0d969bf

    As the timer_shutdown*() code is now in your tree, I figured
    we can start doing the conversions. At least add the trivial ones
    now as Thomas suggested that this gets applied at the end of the
    merge window, to avoid conflicts with linux-next during the
    development cycle. I can wait to Friday to run it again, and
    resubmit.

    What is the best way to handle this?
]

From: "Steven Rostedt (Google)" <rostedt@goodmis.org>

Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called "shutdown". After a timer is set to this state, then it can no
longer be re-armed.

The following script was run to find all the trivial locations where
del_timer() or del_timer_sync() is called in the same function that the
object holding the timer is freed. It also ignores any locations where the
timer->function is modified between the del_timer*() and the free(), as
that is not considered a "trivial" case.

This was created by using a coccinelle script and the following commands:

 $ cat timer.cocci
@@
expression ptr, slab;
identifier timer, rfield;
@@
(
-       del_timer(&ptr->timer);
+       timer_shutdown(&ptr->timer);
|
-       del_timer_sync(&ptr->timer);
+       timer_shutdown_sync(&ptr->timer);
)
  ... when strict
      when != ptr->timer
(
        kfree_rcu(ptr, rfield);
|
        kmem_cache_free(slab, ptr);
|
        kfree(ptr);
)

 $ spatch timer.cocci . > /tmp/t.patch
 $ patch -p1 < /tmp/t.patch

Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/ (local)

Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

For wireless:

 .../broadcom/brcm80211/brcmfmac/btcoex.c         |  2 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c |  2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c     |  2 +-
 drivers/net/wireless/intersil/hostap/hostap_ap.c |  2 +-
 drivers/net/wireless/marvell/mwifiex/main.c      |  2 +-
 drivers/net/wireless/microchip/wilc1000/hif.c    |  6 +++---

Acked-by: Kalle Valo <kvalo@kernel.org>

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches