RE: [PATCH v2 1/2] wifi: iwlwifi: mvm: fix race condition in PTP removal
From: "Korenblit, Miriam Rachel" <miriam.rachel.korenblit@intel.com>
Date: 2026-03-30 06:44:03
Also in:
linux-wireless, lkml, stable
-----Original Message----- From: Cao, Junjie <redacted> Sent: Thursday, February 12, 2026 2:51 PM To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>; Berg, Johannes [off-list ref]; linux-wireless@vger.kernel.org; richardcochran@gmail.com Cc: horms@kernel.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; yedidya.ben.shimol@intel.com; Stern, Avraham [off-list ref]; Gabay, Daniel [off-list ref]; Prabhu, Krishnanand [off-list ref]; Coelho, Luciano [off-list ref]; gregory.greenman@intel.com; stable@vger.kernel.org; Cao, Junjie [off-list ref]; Vadim Fedorenko [off-list ref] Subject: [PATCH v2 1/2] wifi: iwlwifi: mvm: fix race condition in PTP removal iwl_mvm_ptp_remove() calls cancel_delayed_work_sync() only after ptp_clock_unregister() and clearing ptp_data state (ptp_clock, ptp_clock_info, last_gp2). This creates a race where the delayed work iwl_mvm_ptp_work() can execute between ptp_clock_unregister() and cancel_delayed_work_sync(), observing partially cleared PTP state.
But the work runs under the mvm mutex, and so does iwl_mvm_ptp_remove, so not sure how such a race can happen?
quoted hunk ↗ jump to hunk
Move cancel_delayed_work_sync() before ptp_clock_unregister() to ensure the delayed work is fully stopped before any PTP cleanup begins. Fixes: 1595ecce1cf3 ("wifi: iwlwifi: mvm: add support for PTP HW clock (PHC)") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Signed-off-by: Junjie Cao <redacted> --- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.cb/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c index ad156b82eaa9..efb291ceb0e5 100644--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c@@ -323,11 +323,11 @@ void iwl_mvm_ptp_remove(struct iwl_mvm *mvm) mvm->ptp_data.ptp_clock_info.name, ptp_clock_index(mvm->ptp_data.ptp_clock)); + cancel_delayed_work_sync(&mvm->ptp_data.dwork); ptp_clock_unregister(mvm->ptp_data.ptp_clock); mvm->ptp_data.ptp_clock = NULL; memset(&mvm->ptp_data.ptp_clock_info, 0, sizeof(mvm->ptp_data.ptp_clock_info)); mvm->ptp_data.last_gp2 = 0; - cancel_delayed_work_sync(&mvm->ptp_data.dwork); } } --2.48.1