)]}'
{
  "commit": "1eeca1d5e0920fbdad6449768fd2d4364e714180",
  "tree": "292c97d02b6da107103c4f46562427fbe67da82e",
  "parents": [
    "621d90169cef6c8da5b6134db5c0c4e23cdd09ce"
  ],
  "author": {
    "name": "Jiangshan Yi",
    "email": "yijiangshan@kylinos.cn",
    "time": "Sat Aug 15 20:10:43 2026 +0800"
  },
  "committer": {
    "name": "Johannes Berg",
    "email": "johannes.berg@intel.com",
    "time": "Tue Sep 15 11:52:56 2026 +0200"
  },
  "message": "wifi: brcmsmac: fix UAF in brcms_free_timer()\n\nbrcms_free_timer() calls brcms_del_timer() which uses the non-synchronous\ncancel_delayed_work() to cancel the timer\u0027s underlying delayed work.  If\nthe work callback (_brcms_timer) is already running, cancel_delayed_work()\nreturns false without waiting, and brcms_free_timer() proceeds to kfree(t)\nwhile the callback still accesses t through container_of().\n\nAdd an explicit cancel_delayed_work_sync() after brcms_del_timer() to\nguarantee that any in-flight callback has completed before the timer\nstructure is freed.\n\nFixes: 5b435de0d786 (\"net: wireless: add brcm80211 drivers\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jiangshan Yi \u003cyijiangshan@kylinos.cn\u003e\nAcked-by: Arend van Spriel \u003carend.vanspriel@broadcom.com\u003e\nLink: https://patch.msgid.link/20260815121043.938414-1-yijiangshan@kylinos.cn\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6255d673d2d3e305babed0f3db3935d2ef16c4c0",
      "old_mode": 33188,
      "old_path": "drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c",
      "new_id": "c1a2318d7ea6f104cd9bff236acad9badb965a00",
      "new_mode": 33188,
      "new_path": "drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c"
    }
  ]
}