[PATCH] wifi: ath9k: stop using owl context after completion

[PATCH] wifi: ath9k: stop using owl context after completion

[Hongyan Xu]

owl_remove() waits for eeprom_load, but both owl_fw_cb() and
owl_nvmem_work() completed it before their last uses of ctx. The
devm-allocated context can therefore be freed while the async path still
dereferences it.

Take a pci_dev reference and copy ctx-owned pointers while ctx is still
protected. Complete only after ctx is no longer needed.
Keep the completion before owl_rescan(). Rescan can remove the device
synchronously.

This issue was found by a static analysis tool.

Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 .../wireless/ath/ath9k/ath9k_pci_owl_loader.c | 31 ++++++++++++-------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c b/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
index fe1013a3a..1aefe21d2 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
+++ b/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
@@ -125,16 +125,19 @@ static void owl_rescan(struct pci_dev *pdev)
 static void owl_fw_cb(const struct firmware *fw, void *context)
 {
 	struct owl_ctx *ctx = context;
-
-	complete(&ctx->eeprom_load);
+	struct pci_dev *pdev = pci_dev_get(ctx->pdev);
 
 	if (fw) {
-		ath9k_pci_fixup(ctx->pdev, (const u16 *)fw->data, fw->size);
-		owl_rescan(ctx->pdev);
+		ath9k_pci_fixup(pdev, (const u16 *)fw->data, fw->size);
+		release_firmware(fw);
+		complete(&ctx->eeprom_load);
+		owl_rescan(pdev);
 	} else {
-		dev_err(&ctx->pdev->dev, "no eeprom data received.\n");
+		dev_err(&pdev->dev, "no eeprom data received.\n");
+		complete(&ctx->eeprom_load);
 	}
-	release_firmware(fw);
+
+	pci_dev_put(pdev);
 }
 
 static const char *owl_get_eeprom_name(struct pci_dev *pdev)
@@ -158,19 +161,23 @@ static const char *owl_get_eeprom_name(struct pci_dev *pdev)
 static void owl_nvmem_work(struct work_struct *work)
 {
 	struct owl_ctx *ctx = container_of(work, struct owl_ctx, work);
+	struct pci_dev *pdev = pci_dev_get(ctx->pdev);
+	struct nvmem_cell *cell = ctx->cell;
 	void *buf;
 	size_t len;
 
-	complete(&ctx->eeprom_load);
-
-	buf = nvmem_cell_read(ctx->cell, &len);
+	buf = nvmem_cell_read(cell, &len);
 	if (!IS_ERR(buf)) {
-		ath9k_pci_fixup(ctx->pdev, buf, len);
+		ath9k_pci_fixup(pdev, buf, len);
 		kfree(buf);
-		owl_rescan(ctx->pdev);
+		complete(&ctx->eeprom_load);
+		owl_rescan(pdev);
 	} else {
-		dev_err(&ctx->pdev->dev, "no nvmem data received.\n");
+		dev_err(&pdev->dev, "no nvmem data received.\n");
+		complete(&ctx->eeprom_load);
 	}
+
+	pci_dev_put(pdev);
 }
 
 static int owl_nvmem_probe(struct owl_ctx *ctx)
-- 
2.50.1.windows.1