[PATCH] wifi: ath9k: stop WMI event tasklet from rescheduling itself on probe failure

[PATCH] wifi: ath9k: stop WMI event tasklet from rescheduling itself on probe failure

[Deepanshu Kartikey]

Since the init guards were consolidated, ath9k_wmi_event_tasklet()
reschedules itself until priv->initialized is set. If
ath9k_init_device() fails, initialized is never set, so the tasklet
keeps rescheduling itself while the probe error path calls
ath9k_destroy_wmi() and frees struct wmi. tasklet_action_common() then
touches the freed tasklet, causing a slab-use-after-free.

Make the tasklet drop its queued events and stop rescheduling once
wmi->stopped is set, and call tasklet_kill() before freeing wmi in
ath9k_destroy_wmi(). The probe error path already sets stopped and
kills the RX URBs first, so the tasklet cannot be re-armed afterwards.

Fixes: 1af8dc9ca726 ("wifi: ath9k: Clean up device initialisation guards")
Reported-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e91dc13b1b37759b3d9f
Tested-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/net/wireless/ath/ath9k/wmi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 4a08babb6d9d..f8b174b0f209 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -122,6 +122,10 @@ void ath9k_stop_wmi(struct ath9k_htc_priv *priv)
 
 void ath9k_destroy_wmi(struct ath9k_htc_priv *priv)
 {
+	struct wmi *wmi = priv->wmi;
+
+	tasklet_kill(&wmi->wmi_event_tasklet);
+	skb_queue_purge(&wmi->wmi_event_queue);
 	kfree(priv->wmi);
 }
 
@@ -148,6 +152,10 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
 
 	/* Check if ath9k_init_device() completed. */
 	if (!smp_load_acquire(&priv->initialized)) {
+		if (READ_ONCE(wmi->stopped)) {
+			skb_queue_purge(&wmi->wmi_event_queue);
+			return;
+		}
 		tasklet_schedule(t);
 		return;
 	}
-- 
2.43.0

Re: [PATCH] wifi: ath9k: stop WMI event tasklet from rescheduling itself on probe failure

[Deepanshu Kartikey]

On Sat, Oct 3, 2026 at 7:41 AM Deepanshu Kartikey <kartikey406@gmail.com> wrote:
>
> Since the init guards were consolidated, ath9k_wmi_event_tasklet()
> reschedules itself until priv->initialized is set. If
> ath9k_init_device() fails, initialized is never set, so the tasklet
> keeps rescheduling itself while the probe error path calls
> ath9k_destroy_wmi() and frees struct wmi. tasklet_action_common() then
> touches the freed tasklet, causing a slab-use-after-free.
>
> Make the tasklet drop its queued events and stop rescheduling once
> wmi->stopped is set, and call tasklet_kill() before freeing wmi in
> ath9k_destroy_wmi(). The probe error path already sets stopped and
> kills the RX URBs first, so the tasklet cannot be re-armed afterwards.
>
> Fixes: 1af8dc9ca726 ("wifi: ath9k: Clean up device initialisation guards")
> Reported-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=e91dc13b1b37759b3d9f
> Tested-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/net/wireless/ath/ath9k/wmi.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
> index 4a08babb6d9d..f8b174b0f209 100644
> --- a/drivers/net/wireless/ath/ath9k/wmi.c
> +++ b/drivers/net/wireless/ath/ath9k/wmi.c
> @@ -122,6 +122,10 @@ void ath9k_stop_wmi(struct ath9k_htc_priv *priv)
>
>  void ath9k_destroy_wmi(struct ath9k_htc_priv *priv)
>  {
> +       struct wmi *wmi = priv->wmi;
> +
> +       tasklet_kill(&wmi->wmi_event_tasklet);
> +       skb_queue_purge(&wmi->wmi_event_queue);
>         kfree(priv->wmi);
>  }
>
> @@ -148,6 +152,10 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
>
>         /* Check if ath9k_init_device() completed. */
>         if (!smp_load_acquire(&priv->initialized)) {
> +               if (READ_ONCE(wmi->stopped)) {
> +                       skb_queue_purge(&wmi->wmi_event_queue);
> +                       return;
> +               }
>                 tasklet_schedule(t);
>                 return;
>         }
> --
> 2.43.0
>

Gentle Reminder. Please let me know the status of this patch.

Thanks

Deepanshu

Re: [PATCH] wifi: ath9k: stop WMI event tasklet from rescheduling itself on probe failure

[Toke Høiland-Jørgensen]

Deepanshu Kartikey <kartikey406@gmail.com> writes:

> Since the init guards were consolidated, ath9k_wmi_event_tasklet()
> reschedules itself until priv->initialized is set. If
> ath9k_init_device() fails, initialized is never set, so the tasklet
> keeps rescheduling itself while the probe error path calls
> ath9k_destroy_wmi() and frees struct wmi. tasklet_action_common() then
> touches the freed tasklet, causing a slab-use-after-free.
>
> Make the tasklet drop its queued events and stop rescheduling once
> wmi->stopped is set, and call tasklet_kill() before freeing wmi in
> ath9k_destroy_wmi(). The probe error path already sets stopped and
> kills the RX URBs first, so the tasklet cannot be re-armed afterwards.
>
> Fixes: 1af8dc9ca726 ("wifi: ath9k: Clean up device initialisation guards")
> Reported-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=e91dc13b1b37759b3d9f
> Tested-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>

Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>