Forwarded: [PATCH] wifi: ath9k: kill WMI event tasklet before freeing wmi

[syzbot <syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] wifi: ath9k: kill WMI event tasklet before freeing wmi
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


The device becomes visible to the HTC/WMI RX path before
ath9k_htc_probe_device() has finished. If probe fails, the error path
stops WMI and kills the RX URBs, but ath9k_destroy_wmi() then frees
struct wmi while wmi_event_tasklet may still be scheduled from an event
that arrived earlier. tasklet_action_common() later walks the softirq
list and reads the freed tasklet, causing a slab-use-after-free.

Call tasklet_kill() and purge wmi_event_queue before kfree(). Callers
already set wmi->stopped and kill the RX URBs first, so the tasklet
cannot be re-armed after this point.

Reported-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e91dc13b1b37759b3d9f
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/net/wireless/ath/ath9k/wmi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 4a08babb6d9d..a629de91015b 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -122,6 +122,9 @@ void ath9k_stop_wmi(struct ath9k_htc_priv *priv)
 
 void ath9k_destroy_wmi(struct ath9k_htc_priv *priv)
 {
+	struct wmi *wmi = priv->wmi;
+	tasklet_kill(&wmi->wmi_event_tasklet);
+	skb_queue_purge(&wmi->wmi_event_queue);
 	kfree(priv->wmi);
 }
 
-- 
2.43.0