Re: [PATCH] tty: ipwireless: Fix use-after-free in tasklet during device removal

[Greg KH <gregkh@linuxfoundation.org>]

On Sun, Feb 08, 2026 at 06:28:19PM +0800, duoming@zju.edu.cn wrote:
> On Sun, 8 Feb 2026 07:38:00 +0100 Greg KH wrote:
> > > When IPWireless PCMCIA card is being detached, the ipw_hardware is
> > > deallocated in ipwireless_hardware_free(). However, the hw->tasklet may
> > > still be running or pending, leading to use-after-free bugs when the
> > > already freed ipw_hardware is accessed again in ipwireless_do_tasklet().
> > 
> > Nice, do you have this hardware to test this with?
> 
> I don't have the real hardware. In order to reproduce the bug, I simulate 
> the IPWireless PCMCIA card in the qemu by allocating and configuring the 
> necessary resources(I/O ports, memory regions, interrupts and so on) to
> correspond with the hardware expected by the driver in the initialization 
> code of the virtual device.

I wonder if this device even is still around, given that pcmcia is all
but dead for a very long time.

> > > One race condition scenario is as follows:
> > > 
> > > CPU 0 (cleanup)               | CPU 1 (interrupt)
> > > ipwireless_hardware_free()    | ipwireless_interrupt()
> > >   ipwireless_stop_interrupts()|   ipwireless_handle_v1_interrupt()
> > >     do_close_hardware()       |     tasklet_schedule()
> > >       synchronize_irq()       |
> > >   kfree(hw) //FREE            | ipwireless_do_tasklet() //handler
> > >                               |   hw = from_tasklet() //USE
> > >                               |   hw-> //USE
> > > 
> > > Fix this by ensuring hw->tasklet is properly canceled before ipw_hardware
> > > is released. Add tasklet_kill() in ipwireless_stop_interrupts() to
> > > synchronize with any pending or running tasklet. Since do_close_hardware()
> > > could prevent further interrupts, place tasklet_kill() after it to avoid
> > > the tasklet being rescheduled by ipwireless_interrupt().
> > 
> > How was this issue found and tested?
> 
> The issue was found by static analysis. I test it through the following steps:
> 1. Simulating the IPWireless PCMCIA device in the qemu and enable it to trigger interrupts.
> 2. Controlling the removal and attachment of device via sysfs.

So this is with the bind/unbind logic, or some other way?  If you are
unloading the driver, that is something that only root can do, and this
is a debugging facility, not a "real" way to control drivers and devices
(yes, the virt drivers abuse this to no end, every time I see this I
laugh...)

> 3. Triggering interrupts by writing data to device registers via /dev/mem memory mapping
>    in userspace.

Interrupts would not happen if the device is removed.  Or is this only
if the driver is unbound?

> 4. In order to ensure that there are unfinished tasklet during the removal process, I
>    manually inject delays such as mdelay() into tasklet handler.

That's a lot of work for a piece of obsolete hardware, but hey, thanks
for doing this!

> > > Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
> > > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> > 
> > No CC: stable?  Why not?
> 
> Thanks for checking, You are right, it should go to the stable.

Let's see what the maintainers of this driver say.

thanks,

greg k-h