Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Sender: kvalo=codeaurora.org@mg.codeaurora.org
DMARC-Filter: OpenDMARC Filter v1.4.1 smtp.codeaurora.org C9D74C43460
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
From:   Kalle Valo <kvalo@codeaurora.org>
In-Reply-To: <1634356979-6211-1-git-send-email-zheyuma97@gmail.com>
References: <1634356979-6211-1-git-send-email-zheyuma97@gmail.com>
To:     Zheyu Ma <zheyuma97@gmail.com>
Cc:     davem@davemloft.net, kuba@kernel.org,
        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, Zheyu Ma <zheyuma97@gmail.com>
User-Agent: pwcli/0.1.0-git (https://github.com/kvalo/pwcli/) Python/3.7.3
Message-ID: <163471929329.1743.12412920889639302188.kvalo@codeaurora.org>
Date:   Wed, 20 Oct 2021 08:41:38 +0000 (UTC)
Precedence: bulk

Zheyu Ma <zheyuma97@gmail.com> wrote:

> When the driver fails to request the firmware, it calls its error
> handler. In the error handler, the driver detaches device from driver
> first before releasing the firmware, which can cause a use-after-free bug.
> 
> Fix this by releasing firmware first.
> 
> The following log reveals it:
> 
> [    9.007301 ] BUG: KASAN: use-after-free in mwl8k_fw_state_machine+0x320/0xba0
> [    9.010143 ] Workqueue: events request_firmware_work_func
> [    9.010830 ] Call Trace:
> [    9.010830 ]  dump_stack_lvl+0xa8/0xd1
> [    9.010830 ]  print_address_description+0x87/0x3b0
> [    9.010830 ]  kasan_report+0x172/0x1c0
> [    9.010830 ]  ? mutex_unlock+0xd/0x10
> [    9.010830 ]  ? mwl8k_fw_state_machine+0x320/0xba0
> [    9.010830 ]  ? mwl8k_fw_state_machine+0x320/0xba0
> [    9.010830 ]  __asan_report_load8_noabort+0x14/0x20
> [    9.010830 ]  mwl8k_fw_state_machine+0x320/0xba0
> [    9.010830 ]  ? mwl8k_load_firmware+0x5f0/0x5f0
> [    9.010830 ]  request_firmware_work_func+0x172/0x250
> [    9.010830 ]  ? read_lock_is_recursive+0x20/0x20
> [    9.010830 ]  ? process_one_work+0x7a1/0x1100
> [    9.010830 ]  ? request_firmware_nowait+0x460/0x460
> [    9.010830 ]  ? __this_cpu_preempt_check+0x13/0x20
> [    9.010830 ]  process_one_work+0x9bb/0x1100
> 
> Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>

Patch applied to wireless-drivers-next.git, thanks.

257051a235c1 mwl8k: Fix use-after-free in mwl8k_fw_state_machine()

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/1634356979-6211-1-git-send-email-zheyuma97@gmail.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches