Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 8 Feb 2022 12:20:46 +0100
From:   Marek =?utf-8?Q?Marczykowski-G=C3=B3recki?= 
        <marmarek@invisiblethingslab.com>
To:     Johannes Berg <johannes@sipsolutions.net>
Cc:     linux-wireless@vger.kernel.org,
        Johannes Berg <johannes.berg@intel.com>,
        stable@vger.kernel.org, Stefan Agner <stefan@agner.ch>,
        Wolfgang Walter <linux@stwm.de>,
        Jason Self <jason@bluehome.net>,
        Dominik Behr <dominik@dominikbehr.com>
Subject: Re: [PATCH] iwlwifi: fix use-after-free
Message-ID: <YgJSEEmRDKKG+3lT@mail-itl>
References: <20220208114728.e6b514cf4c85.Iffb575ca2a623d7859b542c33b2a507d01554251@changeid>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="Rj3/8RxUIYFHdmTV"
Content-Disposition: inline
In-Reply-To: <20220208114728.e6b514cf4c85.Iffb575ca2a623d7859b542c33b2a507d01554251@changeid>
Precedence: bulk


--Rj3/8RxUIYFHdmTV
Content-Type: text/plain; protected-headers=v1; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Date: Tue, 8 Feb 2022 12:20:46 +0100
From: Marek =?utf-8?Q?Marczykowski-G=C3=B3recki?= <marmarek@invisiblethingslab.com>
To: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-wireless@vger.kernel.org, Johannes Berg <johannes.berg@intel.com>,
	stable@vger.kernel.org, Stefan Agner <stefan@agner.ch>,
	Wolfgang Walter <linux@stwm.de>, Jason Self <jason@bluehome.net>,
	Dominik Behr <dominik@dominikbehr.com>
Subject: Re: [PATCH] iwlwifi: fix use-after-free

On Tue, Feb 08, 2022 at 11:47:30AM +0100, Johannes Berg wrote:
> From: Johannes Berg <johannes.berg@intel.com>
>=20
> If no firmware was present at all (or, presumably, all of the
> firmware files failed to parse), we end up unbinding by calling
> device_release_driver(), which calls remove(), which then in
> iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However
> the new code I added will still erroneously access it after it
> was freed.
>=20
> Set 'failure=3Dfalse' in this case to avoid the access, all data
> was already freed anyway.
>=20
> Cc: stable@vger.kernel.org
> Reported-by: Stefan Agner <stefan@agner.ch>
> Reported-by: Wolfgang Walter <linux@stwm.de>
> Reported-by: Jason Self <jason@bluehome.net>
> Reported-by: Dominik Behr <dominik@dominikbehr.com>
> Reported-by: Marek Marczykowski-G=C3=B3recki <marmarek@invisiblethingslab=
=2Ecom>
> Fixes: ab07506b0454 ("iwlwifi: fix leaks/bad data after failed firmware l=
oad")
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Tested-by: Marek Marczykowski-G=C3=B3recki <marmarek@invisiblethingslab.com>

Thanks!

> ---
>  drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 ++
>  1 file changed, 2 insertions(+)
>=20
> diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/w=
ireless/intel/iwlwifi/iwl-drv.c
> index 83e3b731ad29..6651e78b39ec 100644
> --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
> +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
> @@ -1707,6 +1707,8 @@ static void iwl_req_fw_callback(const struct firmwa=
re *ucode_raw, void *context)
>   out_unbind:
>  	complete(&drv->request_firmware_complete);
>  	device_release_driver(drv->trans->dev);
> +	/* drv has just been freed by the release */
> +	failure =3D false;
>   free:
>  	if (failure)
>  		iwl_dealloc_ucode(drv);
> --=20
> 2.34.1
>=20

--=20
Best Regards,
Marek Marczykowski-G=C3=B3recki
Invisible Things Lab

--Rj3/8RxUIYFHdmTV
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAmICUhAACgkQ24/THMrX
1ywGRgf/YiqF+79qOU1oFpLynQ3coyrojc0nCj9bFdMf0PVwfbSDXggH7a3gHzaC
oq5FTdMGbeWysH7dmO/Hea9ppxwMfaVhcopzWmeCpvbPTTse1fpjbYlCwjA8KNHN
mLa5Yz1koLxDLnynovAj9+UiJ4ILFnPJ4/IiVC77Fc862TsEooM/cpnmxoJaVCSD
9HGmlxdoGBq/o5h1t49C4dsJwMoW7gyCHi2KkfHfjZixUaNv26Ta/sDvUvBnoh8R
j+HKSIkGdsJOZn3Z7gU84x6RCcZKRUmBZc6Z/9NSSoN0KZHr3JavIMOjoVl1z2Ca
PIBGTs7aBARQTSJg2ATt08jXXqOG9g==
=HjcN
-----END PGP SIGNATURE-----

--Rj3/8RxUIYFHdmTV--