Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5;
MIME-Version: 1.0
References: <20231106141704.866455-1-zyytlz.wz@163.com> <87o7g7ueom.fsf@kernel.org>
 <CAJedcCytuGmvubqbSZgsU3Db=rg=xM+kSuLZn8BSvA18Yn+9Jw@mail.gmail.com>
 <18ba5520da0.279b.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com>
 <CAJedcCxoL+L1QPaZty27k6kqR2JRjxPVY=BV5xn7BSPojbxe=A@mail.gmail.com>
 <fa0e7536-9b05-42fb-9fff-acd2ffad9af9@broadcom.com> <CAJedcCzj9SFbx-=xDymqJyV2fu0xjmz2RH4+gT+Gxsqubg35ZA@mail.gmail.com>
 <18bd95c97f0.279b.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com> <87h6llmu7t.wl-tiwai@suse.de>
In-Reply-To: <87h6llmu7t.wl-tiwai@suse.de>
From:   Zheng Hacker <hackerzheng666@gmail.com>
Date:   Fri, 17 Nov 2023 10:31:26 +0800
Message-ID: <CAJedcCzTv5oT-=+DaT6pCnor9QijUWGEkxg0PcZRWQDHxTWPeA@mail.gmail.com>
Subject: Re: [PATCH v5] wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
To:     Takashi Iwai <tiwai@suse.de>
Cc:     Arend Van Spriel <arend.vanspriel@broadcom.com>,
        Kalle Valo <kvalo@kernel.org>, Zheng Wang <zyytlz.wz@163.com>,
        aspriel@gmail.com, franky.lin@broadcom.com,
        hante.meuleman@broadcom.com, johannes.berg@intel.com,
        marcan@marcan.st, linus.walleij@linaro.org,
        jisoo.jang@yonsei.ac.kr, linuxlovemin@yonsei.ac.kr,
        wataru.gohda@cypress.com, linux-wireless@vger.kernel.org,
        brcm80211-dev-list.pdl@broadcom.com,
        SHA-cyfmac-dev-list@infineon.com, linux-kernel@vger.kernel.org,
        security@kernel.org, stable@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Yes, that makes this issue hard to fix. I was wondering why it binds the
worker with the timer rather than using just one of them.

Takashi Iwai <tiwai@suse.de> =E4=BA=8E2023=E5=B9=B411=E6=9C=8817=E6=97=A5=
=E5=91=A8=E4=BA=94 02:25=E5=86=99=E9=81=93=EF=BC=9A
>
> On Thu, 16 Nov 2023 19:20:06 +0100,
> Arend Van Spriel wrote:
> >
> > On November 15, 2023 4:00:46 PM Zheng Hacker <hackerzheng666@gmail.com>=
 wrote:
> >
> > > Arend van Spriel <arend.vanspriel@broadcom.com> =E4=BA=8E2023=E5=B9=
=B411=E6=9C=8813=E6=97=A5=E5=91=A8=E4=B8=80 17:18=E5=86=99=E9=81=93=EF=BC=
=9A
> > >>
> > >> On November 8, 2023 4:03:26 AM Zheng Hacker <hackerzheng666@gmail.co=
m>
> > >> wrote:
> > >>
> > >>> Arend Van Spriel <arend.vanspriel@broadcom.com> =E4=BA=8E2023=E5=B9=
=B411=E6=9C=886=E6=97=A5=E5=91=A8=E4=B8=80 23:48=E5=86=99=E9=81=93=EF=BC=9A
> > >>>>
> > >>>> On November 6, 2023 3:44:53 PM Zheng Hacker <hackerzheng666@gmail.=
com> wrote:
> > >>>>
> > >>>>> Thanks! I didn't test it for I don't have a device. Very apprecia=
ted
> > >>>>> if anyone could help with that.
> > >>>>
> > >>>> I would volunteer, but it made me dig deep and not sure if there i=
s a
> > >>>> problem to solve here.
> > >>>>
> > >>>> brcmf_cfg80211_detach() calls wl_deinit_priv() -> brcmf_abort_scan=
ning() ->
> > >>>> brcmf_notify_escan_complete() which does delete the timer.
> > >>>>
> > >>>> What am I missing here?
> > >>>
> > >>> Thanks four your detailed review. I did see the code and not sure i=
f
> > >>> brcmf_notify_escan_complete
> > >>> would be triggered for sure. So in the first version I want to dele=
te
> > >>> the pending timer ahead of time.
> > >>
> > >> Why requesting a CVE when you are not sure? Seems a bit hasty to put=
 it
> > >> mildly.
> > >
> > > I'm sure the issue exists because there's only cancler of timer but n=
ot woker.
> > > As there's similar CVEs before like : https://github.com/V4bel/CVE-20=
22-41218,
> > > I submit it as soon as I found it.
> >
> > Ah, yes. The cancel_work_sync() can also be done in
> > brcmf_notify_escan_complete().
>
> AFAIUC, brcmf_notify_scan_complete() is called from the work itself,
> too, hence you can't issue cancel_work_sync() there (unless you make
> it conditional).
>
>
> Takashi