)]}'
{
  "commit": "d9be5e75530772fc31637070d51e5717d6aeaa2a",
  "tree": "94b61b55053045d74b913dc569f2be6c058a035a",
  "parents": [
    "ce9d5197d651cdd0fbb586c3d77c28438abe1b10"
  ],
  "author": {
    "name": "Fan Wu",
    "email": "fanwu01@zju.edu.cn",
    "time": "Thu Sep 10 02:09:07 2026 +0000"
  },
  "committer": {
    "name": "Jeff Johnson",
    "email": "jeff.johnson@oss.qualcomm.com",
    "time": "Mon Sep 14 11:43:30 2026 -0700"
  },
  "message": "wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown\n\nwcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),\nwhich only dequeues the timer and does not wait for a callback that is\nalready executing; the preceding free_irq() calls synchronize the\ninterrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can\ntherefore be running past the teardown and use the wcn freed along\nwith the ieee80211_hw in wcn36xx_remove(): it takes wcn-\u003edxe_lock,\nreads wcn-\u003etx_ack_skb and passes wcn-\u003ehw to\nieee80211_tx_status_irqsafe().\n\nFix this by using timer_shutdown_sync(), which waits for a running\ncallback and also prevents the timer from being rearmed again. The\ntimer is set up again by wcn36xx_dxe_init() on the next start, so the\nstart/stop cycle is unaffected.\n\nThis issue was found by an in-house static analysis tool.\n\nFixes: fdf21cc37149 (\"wcn36xx: Add TX ack support\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nCo-developed-by: Song Li \u003csongl@zju.edu.cn\u003e\nSigned-off-by: Song Li \u003csongl@zju.edu.cn\u003e\nSigned-off-by: Fan Wu \u003cfanwu01@zju.edu.cn\u003e\nReviewed-by: Loic Poulain \u003cloic.poulain@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260910020907.3353-1-fanwu01@zju.edu.cn\nSigned-off-by: Jeff Johnson \u003cjeff.johnson@oss.qualcomm.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "44020ec265fb69b9d0ee75903a812adcee90d1c8",
      "old_mode": 33188,
      "old_path": "drivers/net/wireless/ath/wcn36xx/dxe.c",
      "new_id": "801f1218ef89bf89443b6bbaa630b90105679a70",
      "new_mode": 33188,
      "new_path": "drivers/net/wireless/ath/wcn36xx/dxe.c"
    }
  ]
}