Re: [PATCH] wifi: b43: fix use-after-free in b43_bcma_remove()

["Michael Büsch" <m@bues.ch>]

[-- Attachment #1: Type: text/plain, Size: 1062 bytes --]

On Tue, 13 Oct 2026 02:01:24 +0200
Andreas Wendleder <gonsolo@gmail.com> wrote:

> --- a/drivers/net/wireless/broadcom/b43/main.c
> +++ b/drivers/net/wireless/broadcom/b43/main.c
> @@ -5677,6 +5677,7 @@ static void b43_bcma_remove(struct bcma_device *core)
>  {
>  	struct b43_wldev *wldev = bcma_get_drvdata(core);
>  	struct b43_wl *wl = wldev->wl;
> +	struct b43_bus_dev *dev = wldev->dev;
>  
>  	/* We must cancel any work here before unregistering from ieee80211,
>  	 * as the ieee80211 unreg will destroy the workqueue. */
> @@ -5691,14 +5692,14 @@ static void b43_bcma_remove(struct bcma_device *core)
>  		ieee80211_unregister_hw(wl->hw);
>  	}
>  
> -	b43_one_core_detach(wldev->dev);
> +	b43_one_core_detach(dev);
>  
>  	/* Unregister HW RNG driver */
>  	b43_rng_exit(wl);
>  
>  	b43_leds_unregister(wl);
>  	ieee80211_free_hw(wl->hw);
> -	kfree(wldev->dev);
> +	kfree(dev);
>  }
>  
>  static struct bcma_driver b43_bcma_driver = {

Reviewed-by: Michael Büsch <m@bues.ch>

-- 
Michael Büsch
https://bues.ch/

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]