Problem

Both iwl_mvm_ptp_remove() and iwl_mld_ptp_remove() unregister the PTP clock before canceling delayed work, allowing the work function to access freed memory.

Changes

• mvm/ptp.c: Move cancel_delayed_work_sync() before ptp_clock_unregister()
• mld/ptp.c: Move cancel_delayed_work_sync() before ptp_clock_unregister()

void iwl_mvm_ptp_remove(struct iwl_mvm *mvm)
{
    if (mvm->ptp_data.ptp_clock) {
        // Cancel work before unregistering to prevent UAF
-       ptp_clock_unregister(mvm->ptp_data.ptp_clock);
-       mvm->ptp_data.ptp_clock = NULL;
-       // ... cleanup ...
-       cancel_delayed_work_sync(&mvm->ptp_data.dwork);
+       cancel_delayed_work_sync(&mvm->ptp_data.dwork);
+       ptp_clock_unregister(mvm->ptp_data.ptp_clock);
+       mvm->ptp_data.ptp_clock = NULL;
+       // ... cleanup ...
    }
}

Ensures no pending or running work can access the clock post-unregistration.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.