[PATCH] wifi: b43: fix use-after-free in b43_bcma_remove()

[Michael Büsch]

On Tue, 13 Oct 2026 02:01:24 +0200
Andreas Wendleder <gonsolo at gmail.com> wrote:

> --- a/drivers/net/wireless/broadcom/b43/main.c
> +++ b/drivers/net/wireless/broadcom/b43/main.c
> @@ -5677,6 +5677,7 @@ static void b43_bcma_remove(struct bcma_device *core)
>  {
>  	struct b43_wldev *wldev = bcma_get_drvdata(core);
>  	struct b43_wl *wl = wldev->wl;
> +	struct b43_bus_dev *dev = wldev->dev;
>  
>  	/* We must cancel any work here before unregistering from ieee80211,
>  	 * as the ieee80211 unreg will destroy the workqueue. */
> @@ -5691,14 +5692,14 @@ static void b43_bcma_remove(struct bcma_device *core)
>  		ieee80211_unregister_hw(wl->hw);
>  	}
>  
> -	b43_one_core_detach(wldev->dev);
> +	b43_one_core_detach(dev);
>  
>  	/* Unregister HW RNG driver */
>  	b43_rng_exit(wl);
>  
>  	b43_leds_unregister(wl);
>  	ieee80211_free_hw(wl->hw);
> -	kfree(wldev->dev);
> +	kfree(dev);
>  }
>  
>  static struct bcma_driver b43_bcma_driver = {

Reviewed-by: Michael Büsch <m at bues.ch>

-- 
Michael Büsch
https://bues.ch/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.infradead.org/pipermail/b43-dev/attachments/20261013/33c46a95/attachment.sig>