The throughput (tpt) LED trigger timer is only stopped in
ieee80211_stop_tpt_led_trig(), which is reached via ieee80211_stop_device()
when the interface is brought down. On a hot unplug, the device is torn down
through ieee80211_unregister_hw() without ever going through
ieee80211_do_stop(), so the timer is never stopped.

ieee80211_led_exit() then frees local->tpt_led_trigger (which embeds the
timer) without cancelling it. The still-armed timer keeps firing and
dereferences the freed tpt_trig, walking local->tpt_led's LED list in
led_trigger_blink() -> led_blink_set_nosleep() on the freed wifi LED class
device, causing a use-after-free page fault in interrupt context.

Call ieee80211_stop_tpt_led_trig() in ieee80211_led_exit(), before
unregistering the trigger and freeing the struct, so the timer is always
stopped and can never run after the trigger/LEDs are torn down.

Fixes: e1e540685437 ("mac80211: add throughput based LED blink trigger")
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 net/mac80211/led.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/mac80211/led.c b/net/mac80211/led.c
index b5600d223452..5a7747dfbfb1 100644
--- a/net/mac80211/led.c
+++ b/net/mac80211/led.c
@@ -9,6 +9,8 @@
 #include <linux/export.h>
 #include "led.h"
 
+static void ieee80211_stop_tpt_led_trig(struct ieee80211_local *local);
+
 void ieee80211_led_assoc(struct ieee80211_local *local, bool associated)
 {
 	if (!atomic_read(&local->assoc_led_active))
@@ -206,6 +208,7 @@ void ieee80211_led_exit(struct ieee80211_local *local)
 		led_trigger_unregister(&local->rx_led);
 
 	if (local->tpt_led_trigger) {
+		ieee80211_stop_tpt_led_trig(local);
 		led_trigger_unregister(&local->tpt_led);
 		kfree(local->tpt_led_trigger);
 	}
-- 
2.55.0

On Tue, 2026-07-14 at 18:47 -0700, Rosen Penev wrote:
> 
> +static void ieee80211_stop_tpt_led_trig(struct ieee80211_local *local);

I'm sure we can get away without a fwd declaration.

johannes