[PATCH net 0/2] s390/ctcm: Fix timer bugs in fsm.c

[Nagamani PV <nagamani@linux.ibm.com>]

Fix two bugs in drivers/s390/net/fsm.c found by Sashiko AI code review.

Patch 1 fixes timer list corruption when fsm_addtimer() is called on
an already-pending timer - timer_setup() re-initializes the timer
list_head while it is still enqueued in the wheel.

Patch 2 fixes a use-after-free in channel_remove() - timer_delete()
returns before any running callback finishes, leaving a window where
the timer callback can access freed memory. Fix by waiting for any
running callback to complete before freeing the channel.

Nagamani PV (2):
  s390/ctcm: fix timer corruption in fsm_addtimer()
  s390/ctcm: fix use-after-free in channel_remove()

 drivers/s390/net/ctcm_main.c |  4 ++--
 drivers/s390/net/fsm.c       | 10 ++--------
 2 files changed, 4 insertions(+), 10 deletions(-)

-- 
2.47.1