[PATCH] wifi: b43: fix use-after-free in b43_bcma_remove()

[PATCH] wifi: b43: fix use-after-free in b43_bcma_remove()

[Andreas Wendleder]

b43_one_core_detach() frees the struct b43_wldev it is given the bus
device of. b43_bcma_remove() then reads wldev->dev again to free the bus
device, which is a read of freed memory.

b43_ssb_remove() does not have the problem: it takes a copy of wldev->dev
at the start. Do the same here.

Fixes: 96838d61102a ("b43: Fix memory leaks in b43_bus_dev_ssb_init and b43_bus_dev_bcma_init")
Cc: stable@vger.kernel.org
Signed-off-by: Andreas Wendleder <gonsolo@gmail.com>
---
 drivers/net/wireless/broadcom/b43/main.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
index 817448e..3825b6a 100644
--- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -5677,6 +5677,7 @@ static void b43_bcma_remove(struct bcma_device *core)
 {
 	struct b43_wldev *wldev = bcma_get_drvdata(core);
 	struct b43_wl *wl = wldev->wl;
+	struct b43_bus_dev *dev = wldev->dev;
 
 	/* We must cancel any work here before unregistering from ieee80211,
 	 * as the ieee80211 unreg will destroy the workqueue. */
@@ -5691,14 +5692,14 @@ static void b43_bcma_remove(struct bcma_device *core)
 		ieee80211_unregister_hw(wl->hw);
 	}
 
-	b43_one_core_detach(wldev->dev);
+	b43_one_core_detach(dev);
 
 	/* Unregister HW RNG driver */
 	b43_rng_exit(wl);
 
 	b43_leds_unregister(wl);
 	ieee80211_free_hw(wl->hw);
-	kfree(wldev->dev);
+	kfree(dev);
 }
 
 static struct bcma_driver b43_bcma_driver = {
-- 
2.54.0


_______________________________________________
b43-dev mailing list
b43-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/b43-dev

Re: [PATCH] wifi: b43: fix use-after-free in b43_bcma_remove()

[Andreas Wendleder]

Adding the people the CI bot listed as not CCed (b43 author and others
working on b43), for information. No changes to the patch.

The bug is in mainline: b43_bcma_remove() reads wldev->dev after
b43_one_core_detach() has freed wldev. b43_ssb_remove() already takes a
copy, so the patch does the same.

Andreas

_______________________________________________
b43-dev mailing list
b43-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/b43-dev

Re: [PATCH] wifi: b43: fix use-after-free in b43_bcma_remove()

[Michael Büsch]

[-- Attachment #1.1: Type: text/plain, Size: 1062 bytes --]

On Tue, 13 Oct 2026 02:01:24 +0200
Andreas Wendleder <gonsolo@gmail.com> wrote:

> --- a/drivers/net/wireless/broadcom/b43/main.c
> +++ b/drivers/net/wireless/broadcom/b43/main.c
> @@ -5677,6 +5677,7 @@ static void b43_bcma_remove(struct bcma_device *core)
>  {
>  	struct b43_wldev *wldev = bcma_get_drvdata(core);
>  	struct b43_wl *wl = wldev->wl;
> +	struct b43_bus_dev *dev = wldev->dev;
>  
>  	/* We must cancel any work here before unregistering from ieee80211,
>  	 * as the ieee80211 unreg will destroy the workqueue. */
> @@ -5691,14 +5692,14 @@ static void b43_bcma_remove(struct bcma_device *core)
>  		ieee80211_unregister_hw(wl->hw);
>  	}
>  
> -	b43_one_core_detach(wldev->dev);
> +	b43_one_core_detach(dev);
>  
>  	/* Unregister HW RNG driver */
>  	b43_rng_exit(wl);
>  
>  	b43_leds_unregister(wl);
>  	ieee80211_free_hw(wl->hw);
> -	kfree(wldev->dev);
> +	kfree(dev);
>  }
>  
>  static struct bcma_driver b43_bcma_driver = {

Reviewed-by: Michael Büsch <m@bues.ch>

-- 
Michael Büsch
https://bues.ch/

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[-- Attachment #2: Type: text/plain, Size: 149 bytes --]

_______________________________________________
b43-dev mailing list
b43-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/b43-dev