-----Original Message-----
From: Korenblit, Miriam Rachel
Sent: Monday, March 30, 2026 9:44 AM
To: Cao, Junjie <redacted>; Berg, Johannes
[off-list ref]; linux-wireless@vger.kernel.org;
richardcochran@gmail.com
Cc: horms@kernel.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org;
yedidya.ben.shimol@intel.com; Stern, Avraham [off-list ref];
Gabay, Daniel [off-list ref]; Prabhu, Krishnanand
[off-list ref]; Coelho, Luciano [off-list ref];
gregory.greenman@intel.com; stable@vger.kernel.org; Vadim Fedorenko
[off-list ref]
Subject: RE: [PATCH v2 1/2] wifi: iwlwifi: mvm: fix race condition in PTP removal

quoted

-----Original Message-----
From: Cao, Junjie <redacted>
Sent: Thursday, February 12, 2026 2:51 PM
To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>;
Berg, Johannes [off-list ref];
linux-wireless@vger.kernel.org; richardcochran@gmail.com
Cc: horms@kernel.org; netdev@vger.kernel.org;
linux-kernel@vger.kernel.org; yedidya.ben.shimol@intel.com; Stern,
Avraham [off-list ref]; Gabay, Daniel
[off-list ref]; Prabhu, Krishnanand
[off-list ref]; Coelho, Luciano
[off-list ref]; gregory.greenman@intel.com;
stable@vger.kernel.org; Cao, Junjie [off-list ref]; Vadim
Fedorenko [off-list ref]
Subject: [PATCH v2 1/2] wifi: iwlwifi: mvm: fix race condition in PTP
removal

iwl_mvm_ptp_remove() calls cancel_delayed_work_sync() only after
ptp_clock_unregister() and clearing ptp_data state (ptp_clock,
ptp_clock_info, last_gp2).

This creates a race where the delayed work iwl_mvm_ptp_work() can
execute between ptp_clock_unregister() and cancel_delayed_work_sync(),
observing partially cleared PTP state.

But the work runs under the mvm mutex, and so does iwl_mvm_ptp_remove, so
not sure how such a race can happen?

Oops, err. It does not run under the mutex. Sorry.
Still note that even with the zeroed data no harm will be done by the worker.

Will apply the patch.

quoted

Move cancel_delayed_work_sync() before ptp_clock_unregister() to
ensure the delayed work is fully stopped before any PTP cleanup begins.

Fixes: 1595ecce1cf3 ("wifi: iwlwifi: mvm: add support for PTP HW clock
(PHC)")
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Junjie Cao <redacted>
---
 drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c

b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
index ad156b82eaa9..efb291ceb0e5 100644

--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c

@@ -323,11 +323,11 @@ void iwl_mvm_ptp_remove(struct iwl_mvm *mvm)
 			       mvm->ptp_data.ptp_clock_info.name,
 			       ptp_clock_index(mvm->ptp_data.ptp_clock));

+		cancel_delayed_work_sync(&mvm->ptp_data.dwork);
 		ptp_clock_unregister(mvm->ptp_data.ptp_clock);
 		mvm->ptp_data.ptp_clock = NULL;
 		memset(&mvm->ptp_data.ptp_clock_info, 0,
 		       sizeof(mvm->ptp_data.ptp_clock_info));
 		mvm->ptp_data.last_gp2 = 0;
-		cancel_delayed_work_sync(&mvm->ptp_data.dwork);
 	}
 }
--

2.48.1