linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zheyu Ma <zheyuma97@gmail.com>, Kalle Valo <kvalo@codeaurora.org>,
	Sasha Levin <sashal@kernel.org>,
	buytenh@wantstofly.org, davem@davemloft.net, kuba@kernel.org,
	keescook@chromium.org, wengjianfeng@yulong.com, arnd@arndb.de,
	christophe.jaillet@wanadoo.fr, lyl2019@mail.ustc.edu.cn,
	linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 29/39] mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
Date: Mon,  8 Nov 2021 20:06:39 -0500	[thread overview]
Message-ID: <20211109010649.1191041-29-sashal@kernel.org> (raw)
In-Reply-To: <20211109010649.1191041-1-sashal@kernel.org>

From: Zheyu Ma <zheyuma97@gmail.com>

[ Upstream commit 257051a235c17e33782b6e24a4b17f2d7915aaec ]

When the driver fails to request the firmware, it calls its error
handler. In the error handler, the driver detaches device from driver
first before releasing the firmware, which can cause a use-after-free bug.

Fix this by releasing firmware first.

The following log reveals it:

[    9.007301 ] BUG: KASAN: use-after-free in mwl8k_fw_state_machine+0x320/0xba0
[    9.010143 ] Workqueue: events request_firmware_work_func
[    9.010830 ] Call Trace:
[    9.010830 ]  dump_stack_lvl+0xa8/0xd1
[    9.010830 ]  print_address_description+0x87/0x3b0
[    9.010830 ]  kasan_report+0x172/0x1c0
[    9.010830 ]  ? mutex_unlock+0xd/0x10
[    9.010830 ]  ? mwl8k_fw_state_machine+0x320/0xba0
[    9.010830 ]  ? mwl8k_fw_state_machine+0x320/0xba0
[    9.010830 ]  __asan_report_load8_noabort+0x14/0x20
[    9.010830 ]  mwl8k_fw_state_machine+0x320/0xba0
[    9.010830 ]  ? mwl8k_load_firmware+0x5f0/0x5f0
[    9.010830 ]  request_firmware_work_func+0x172/0x250
[    9.010830 ]  ? read_lock_is_recursive+0x20/0x20
[    9.010830 ]  ? process_one_work+0x7a1/0x1100
[    9.010830 ]  ? request_firmware_nowait+0x460/0x460
[    9.010830 ]  ? __this_cpu_preempt_check+0x13/0x20
[    9.010830 ]  process_one_work+0x9bb/0x1100

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1634356979-6211-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwl8k.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
index e39aaee92addb..d5f766044221a 100644
--- a/drivers/net/wireless/marvell/mwl8k.c
+++ b/drivers/net/wireless/marvell/mwl8k.c
@@ -5788,8 +5788,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context)
 fail:
 	priv->fw_state = FW_STATE_ERROR;
 	complete(&priv->firmware_loading_complete);
-	device_release_driver(&priv->pdev->dev);
 	mwl8k_release_firmware(priv);
+	device_release_driver(&priv->pdev->dev);
 }
 
 #define MAX_RESTART_ATTEMPTS 1
-- 
2.33.0


  parent reply	other threads:[~2021-11-09  1:20 UTC|newest]

Thread overview: 41+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-09  1:06 [PATCH AUTOSEL 4.14 01/39] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 02/39] Bluetooth: fix use-after-free error in lock_sock_nested() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 03/39] platform/x86: wmi: do not fail if disabling fails Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 04/39] MIPS: lantiq: dma: add small delay after reset Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 05/39] MIPS: lantiq: dma: reset correct number of channel Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 06/39] locking/lockdep: Avoid RCU-induced noinstr fail Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 07/39] smackfs: Fix use-after-free in netlbl_catmap_walk() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 08/39] NET: IPV4: fix error "do not initialise globals to 0" Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 09/39] x86: Increase exception stack sizes Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 10/39] mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type Sasha Levin
2021-11-09 18:06   ` Brian Norris
2021-11-14 14:03     ` Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 11/39] mwifiex: Properly initialize private structure on interface type changes Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 12/39] media: mt9p031: Fix corrupted frame after restarting stream Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 13/39] media: netup_unidvb: handle interrupt properly according to the firmware Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 14/39] media: uvcvideo: Set capability in s_param Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 15/39] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 16/39] media: s5p-mfc: Add checking to s5p_mfc_probe() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 17/39] media: mceusb: return without resubmitting URB in case of -EPROTO error Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 18/39] ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 19/39] ACPICA: Avoid evaluating methods too early during system resume Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 20/39] media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 21/39] tracefs: Have tracefs directories not set OTH permission bits by default Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 22/39] ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 23/39] ACPI: battery: Accept charges over the design capacity as full Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 24/39] leaking_addresses: Always print a trailing newline Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 25/39] memstick: r592: Fix a UAF bug when removing the driver Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 26/39] lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 27/39] lib/xz: Validate the value before assigning it to an enum variable Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 28/39] tracing/cfi: Fix cmp_entries_* functions signature mismatch Sasha Levin
2021-11-09  1:06 ` Sasha Levin [this message]
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 30/39] PM: hibernate: Get block device exclusively in swsusp_check() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 31/39] iwlwifi: mvm: disable RX-diversity in powersave Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 32/39] smackfs: use __GFP_NOFAIL for smk_cipso_doi() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 33/39] ARM: clang: Do not rely on lr register for stacktrace Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 34/39] gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 35/39] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 36/39] spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 37/39] parisc: fix warning in flush_tlb_all Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 38/39] task_stack: Fix end_of_stack() for architectures with upwards-growing stack Sasha Levin
2021-11-09  1:06 ` [PATCH AUTOSEL 4.14 39/39] parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211109010649.1191041-29-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=arnd@arndb.de \
    --cc=buytenh@wantstofly.org \
    --cc=christophe.jaillet@wanadoo.fr \
    --cc=davem@davemloft.net \
    --cc=keescook@chromium.org \
    --cc=kuba@kernel.org \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=lyl2019@mail.ustc.edu.cn \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=wengjianfeng@yulong.com \
    --cc=zheyuma97@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).