Re: [PATCH] tty: ipwireless: Fix use-after-free in tasklet during device removal

[duoming@zju.edu.cn]

On Sun, 8 Feb 2026 07:38:00 +0100 Greg KH wrote:
> > When IPWireless PCMCIA card is being detached, the ipw_hardware is
> > deallocated in ipwireless_hardware_free(). However, the hw->tasklet may
> > still be running or pending, leading to use-after-free bugs when the
> > already freed ipw_hardware is accessed again in ipwireless_do_tasklet().
> 
> Nice, do you have this hardware to test this with?

I don't have the real hardware. In order to reproduce the bug, I simulate 
the IPWireless PCMCIA card in the qemu by allocating and configuring the 
necessary resources(I/O ports, memory regions, interrupts and so on) to
correspond with the hardware expected by the driver in the initialization 
code of the virtual device.

> > 
> > One race condition scenario is as follows:
> > 
> > CPU 0 (cleanup)               | CPU 1 (interrupt)
> > ipwireless_hardware_free()    | ipwireless_interrupt()
> >   ipwireless_stop_interrupts()|   ipwireless_handle_v1_interrupt()
> >     do_close_hardware()       |     tasklet_schedule()
> >       synchronize_irq()       |
> >   kfree(hw) //FREE            | ipwireless_do_tasklet() //handler
> >                               |   hw = from_tasklet() //USE
> >                               |   hw-> //USE
> > 
> > Fix this by ensuring hw->tasklet is properly canceled before ipw_hardware
> > is released. Add tasklet_kill() in ipwireless_stop_interrupts() to
> > synchronize with any pending or running tasklet. Since do_close_hardware()
> > could prevent further interrupts, place tasklet_kill() after it to avoid
> > the tasklet being rescheduled by ipwireless_interrupt().
> 
> How was this issue found and tested?

The issue was found by static analysis. I test it through the following steps:
1. Simulating the IPWireless PCMCIA device in the qemu and enable it to trigger interrupts.
2. Controlling the removal and attachment of device via sysfs.
3. Triggering interrupts by writing data to device registers via /dev/mem memory mapping
   in userspace.
4. In order to ensure that there are unfinished tasklet during the removal process, I
   manually inject delays such as mdelay() into tasklet handler.

> > Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
> > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> 
> No CC: stable?  Why not?

Thanks for checking, You are right, it should go to the stable.

Best regards,
Duoming Zhou