From: Kalle Valo <kvalo@codeaurora.org>
To: Zheyu Ma <zheyuma97@gmail.com>
Cc: davem@davemloft.net, kuba@kernel.org,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, Zheyu Ma <zheyuma97@gmail.com>
Subject: Re: mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
Date: Wed, 20 Oct 2021 08:41:38 +0000 (UTC) [thread overview]
Message-ID: <163471929329.1743.12412920889639302188.kvalo@codeaurora.org> (raw)
In-Reply-To: <1634356979-6211-1-git-send-email-zheyuma97@gmail.com>
Zheyu Ma <zheyuma97@gmail.com> wrote:
> When the driver fails to request the firmware, it calls its error
> handler. In the error handler, the driver detaches device from driver
> first before releasing the firmware, which can cause a use-after-free bug.
>
> Fix this by releasing firmware first.
>
> The following log reveals it:
>
> [ 9.007301 ] BUG: KASAN: use-after-free in mwl8k_fw_state_machine+0x320/0xba0
> [ 9.010143 ] Workqueue: events request_firmware_work_func
> [ 9.010830 ] Call Trace:
> [ 9.010830 ] dump_stack_lvl+0xa8/0xd1
> [ 9.010830 ] print_address_description+0x87/0x3b0
> [ 9.010830 ] kasan_report+0x172/0x1c0
> [ 9.010830 ] ? mutex_unlock+0xd/0x10
> [ 9.010830 ] ? mwl8k_fw_state_machine+0x320/0xba0
> [ 9.010830 ] ? mwl8k_fw_state_machine+0x320/0xba0
> [ 9.010830 ] __asan_report_load8_noabort+0x14/0x20
> [ 9.010830 ] mwl8k_fw_state_machine+0x320/0xba0
> [ 9.010830 ] ? mwl8k_load_firmware+0x5f0/0x5f0
> [ 9.010830 ] request_firmware_work_func+0x172/0x250
> [ 9.010830 ] ? read_lock_is_recursive+0x20/0x20
> [ 9.010830 ] ? process_one_work+0x7a1/0x1100
> [ 9.010830 ] ? request_firmware_nowait+0x460/0x460
> [ 9.010830 ] ? __this_cpu_preempt_check+0x13/0x20
> [ 9.010830 ] process_one_work+0x9bb/0x1100
>
> Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Patch applied to wireless-drivers-next.git, thanks.
257051a235c1 mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
--
https://patchwork.kernel.org/project/linux-wireless/patch/1634356979-6211-1-git-send-email-zheyuma97@gmail.com/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
prev parent reply other threads:[~2021-10-20 8:41 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-16 4:02 [PATCH] mwl8k: Fix UAF in mwl8k_fw_state_machine() Zheyu Ma
2021-10-20 8:41 ` Kalle Valo [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=163471929329.1743.12412920889639302188.kvalo@codeaurora.org \
--to=kvalo@codeaurora.org \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=zheyuma97@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).