[PATCH] wifi: ath9k: make sure we stop the wmi tasklet on init fail

[PATCH] wifi: ath9k: make sure we stop the wmi tasklet on init fail

[Toke Høiland-Jørgensen]

The ath9k_wmi_event_tasklet() reschedules itself until device
initialisation is complete, but if the initialisation fails it is never
interrupted. Syzbot triggered a use-after-free in tasklet_action_common
because of this.

Add a guard to the reschedule logic so it aborts if wmi->stopped is set,
and add a call to ath9k_wmi_event_drain() in ath9k_stop_wmi(), so we are
sure that the queue is drained and the tasklet is stopped on teardown.

Fixes: 1af8dc9ca726 ("wifi: ath9k: Clean up device initialisation guards")
Reported-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e91dc13b1b37759b3d9f
Tested-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
---
 drivers/net/wireless/ath/ath9k/wmi.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 4a08babb6d9d..c60c8b63623d 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -118,6 +118,8 @@ void ath9k_stop_wmi(struct ath9k_htc_priv *priv)
 	mutex_lock(&wmi->op_mutex);
 	wmi->stopped = true;
 	mutex_unlock(&wmi->op_mutex);
+
+	ath9k_wmi_event_drain(priv);
 }
 
 void ath9k_destroy_wmi(struct ath9k_htc_priv *priv)
@@ -148,7 +150,8 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
 
 	/* Check if ath9k_init_device() completed. */
 	if (!smp_load_acquire(&priv->initialized)) {
-		tasklet_schedule(t);
+		if (!READ_ONCE(wmi->stopped))
+			tasklet_schedule(t);
 		return;
 	}
 
-- 
2.56.0

Re: [PATCH] wifi: ath9k: make sure we stop the wmi tasklet on init fail

[Eduard Zateev]

Hi Toke,

I tested this patch with the syzbot C reproducer and KASAN on a 7.3.0 kernel built from upstream commit 21a7f44fd.

On the baseline kernel, the reproducer hit the reported slab-use-after-free in tasklet_action_common during ath9k_htc probe failure. With this patch, the same failure path completed without a KASAN report. Both kernels were run in QEMU with the syzbot config and ath9k firmware extracted from the syzbot rootfs.

Tested-by: Eduard Zateev <hackerowskiy@gmail.com>

Re: [PATCH] wifi: ath9k: make sure we stop the wmi tasklet on init fail

[Toke Høiland-Jørgensen]

Eduard Zateev <hackerowskiy@gmail.com> writes:

> Hi Toke,
>
> I tested this patch with the syzbot C reproducer and KASAN on a 7.3.0
> kernel built from upstream commit 21a7f44fd.
>
> On the baseline kernel, the reproducer hit the reported
> slab-use-after-free in tasklet_action_common during ath9k_htc probe
> failure. With this patch, the same failure path completed without a
> KASAN report. Both kernels were run in QEMU with the syzbot config and
> ath9k firmware extracted from the syzbot rootfs.
>
> Tested-by: Eduard Zateev <hackerowskiy@gmail.com>

Great, thanks for testing! :)

-Toke