[PATCH wireless] wifi: ipw2x00: fix use-after-free in QoS activation work

[PATCH wireless] wifi: ipw2x00: fix use-after-free in QoS activation work

[Sicong Huang]

With CONFIG_IPW2200_QOS enabled, the receive path can schedule
priv->qos_activate to update the firmware's QoS parameters. This
happens when processing association responses or QoS changes in
beacons and probe responses for the associated network. An association
response without QoS parameters can also queue the work to install
default parameters. The work runs on the system workqueue and is
embedded in struct ipw_priv, which lives in the libipw netdev's
private area.

During device removal, ipw_pci_remove() calls ipw_down() and
synchronously cancels the driver's other work items, but omits
qos_activate. unregister_netdev() synchronizes with receive processing,
but does not wait for work those receive callbacks have queued on the
system workqueue. free_irq() does not wait for this work either. The
remove path then calls free_libipw(), freeing the netdev and priv
without waiting for the QoS callback to finish.

One possible interleaving is shown below.

  CPU0 (remove)                   CPU1 (RX tasklet / kworker)
                                  ipw_qos_handle_probe_response()
                                    schedule_work(&priv->qos_activate)
                                  /* Work has not run yet. */
  ipw_pci_remove()
    mutex_lock(&priv->mutex)
    ipw_down()
    mutex_unlock(&priv->mutex)
    unregister_netdev(...)
    cancel_*_sync(...)
    /* qos_activate is not cancelled. */
    free_libipw(...)
      free_netdev(...)
                                  ipw_bg_qos_activate()
                                    /* priv has been freed. */
                                    mutex_lock(&priv->mutex)

The synchronous cancellations were added by commit bcb6d9161d17
("wireless/ipw2x00: use system_wq instead of dedicated workqueues"),
which states that "All used work items are sync canceled on driver
detach". qos_activate was already queued with schedule_work() at that
point and was left out.

Add cancel_work_sync(&priv->qos_activate) alongside the other work
cancellations in ipw_pci_remove(), after unregister_netdev() and
before free_libipw(). This cancels pending work and waits for an
executing callback while priv is still valid.

Found by code inspection.
Fixes: b095c3819805 ("Catch ipw2200 up to equivelancy with v1.0.4")

Signed-off-by: Sicong Huang <congei42@163.com>
---
 drivers/net/wireless/intel/ipw2x00/ipw2200.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index 8249d493ee22..2cdbdcb4e143 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -11786,6 +11786,9 @@ static void ipw_pci_remove(struct pci_dev *pdev)
 	cancel_delayed_work_sync(&priv->led_link_off);
 	cancel_delayed_work_sync(&priv->led_act_off);
 	cancel_work_sync(&priv->merge_networks);
+#ifdef CONFIG_IPW2200_QOS
+	cancel_work_sync(&priv->qos_activate);
+#endif				/* CONFIG_IPW2200_QOS */
 
 	/* Free MAC hash list for ADHOC */
 	for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++) {

base-commit: 9d8ec0b5b5295bd23d979d1b2b905de25c36fff2
-- 
2.34.1