From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB3E3C4321E for ; Tue, 9 Nov 2021 01:23:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AA747610E8 for ; Tue, 9 Nov 2021 01:23:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241959AbhKIB0M (ORCPT ); Mon, 8 Nov 2021 20:26:12 -0500 Received: from mail.kernel.org ([198.145.29.99]:50182 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243456AbhKIBXT (ORCPT ); Mon, 8 Nov 2021 20:23:19 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7267861B1D; Tue, 9 Nov 2021 01:08:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1636420136; bh=E6xC2TBxTIvXTshqm9Z5PDEHQ7VUiWZQdGWelHONzpE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dIbnQ4Z3TYWwOTM5qrkqMBEkSkZ0gj4ohJhZu47cSc5i7RwHQ3Gpfn5A+4orr/5yG VcIerMYiwLz8gsDl8VM7SaUhq/p7nH52LPzzcOXSC6ISGiWFDFpcqRW9IE3nuXJTv6 HzDTKAxu/XJ8v7aH9DIdummiKWl94+5KCnjfzBByRinQjYHg5Et+dlZogwxOKuN/BC qeQXEn53J+pOFr8ey3Hdkuzh60CLPvWGgGe4xYvT7DxC5PP9ssdjSxn5eUp8i0BYWz ij/4Kivzy9/VkrMMgD7FcB4Aff5zHCC1T2W2AkeYzDHQM19yAx1IF06y36jERQWMMn P/XpsD3cioSeA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Zheyu Ma , Kalle Valo , Sasha Levin , buytenh@wantstofly.org, davem@davemloft.net, kuba@kernel.org, christophe.jaillet@wanadoo.fr, arnd@arndb.de, wengjianfeng@yulong.com, lyl2019@mail.ustc.edu.cn, keescook@chromium.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.9 25/33] mwl8k: Fix use-after-free in mwl8k_fw_state_machine() Date: Mon, 8 Nov 2021 20:07:59 -0500 Message-Id: <20211109010807.1191567-25-sashal@kernel.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20211109010807.1191567-1-sashal@kernel.org> References: <20211109010807.1191567-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Zheyu Ma [ Upstream commit 257051a235c17e33782b6e24a4b17f2d7915aaec ] When the driver fails to request the firmware, it calls its error handler. In the error handler, the driver detaches device from driver first before releasing the firmware, which can cause a use-after-free bug. Fix this by releasing firmware first. The following log reveals it: [ 9.007301 ] BUG: KASAN: use-after-free in mwl8k_fw_state_machine+0x320/0xba0 [ 9.010143 ] Workqueue: events request_firmware_work_func [ 9.010830 ] Call Trace: [ 9.010830 ] dump_stack_lvl+0xa8/0xd1 [ 9.010830 ] print_address_description+0x87/0x3b0 [ 9.010830 ] kasan_report+0x172/0x1c0 [ 9.010830 ] ? mutex_unlock+0xd/0x10 [ 9.010830 ] ? mwl8k_fw_state_machine+0x320/0xba0 [ 9.010830 ] ? mwl8k_fw_state_machine+0x320/0xba0 [ 9.010830 ] __asan_report_load8_noabort+0x14/0x20 [ 9.010830 ] mwl8k_fw_state_machine+0x320/0xba0 [ 9.010830 ] ? mwl8k_load_firmware+0x5f0/0x5f0 [ 9.010830 ] request_firmware_work_func+0x172/0x250 [ 9.010830 ] ? read_lock_is_recursive+0x20/0x20 [ 9.010830 ] ? process_one_work+0x7a1/0x1100 [ 9.010830 ] ? request_firmware_nowait+0x460/0x460 [ 9.010830 ] ? __this_cpu_preempt_check+0x13/0x20 [ 9.010830 ] process_one_work+0x9bb/0x1100 Signed-off-by: Zheyu Ma Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1634356979-6211-1-git-send-email-zheyuma97@gmail.com Signed-off-by: Sasha Levin --- drivers/net/wireless/marvell/mwl8k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c index 66cd38d4f199b..c6f008796ff16 100644 --- a/drivers/net/wireless/marvell/mwl8k.c +++ b/drivers/net/wireless/marvell/mwl8k.c @@ -5783,8 +5783,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context) fail: priv->fw_state = FW_STATE_ERROR; complete(&priv->firmware_loading_complete); - device_release_driver(&priv->pdev->dev); mwl8k_release_firmware(priv); + device_release_driver(&priv->pdev->dev); } #define MAX_RESTART_ATTEMPTS 1 -- 2.33.0