Forwarded: [PATCH] wifi: ath9k: stop WMI event tasklet from rescheduling itself on probe failure

[syzbot <syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] wifi: ath9k: stop WMI event tasklet from rescheduling itself on probe failure
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


Since the init guards were consolidated, ath9k_wmi_event_tasklet()
reschedules itself until priv->initialized is set. If
ath9k_init_device() fails, initialized is never set, so the tasklet
keeps rescheduling itself while the probe error path calls
ath9k_destroy_wmi() and frees struct wmi. tasklet_action_common() then
touches the freed tasklet, causing a slab-use-after-free.

Make the tasklet drop its queued events and stop rescheduling once
wmi->stopped is set, and call tasklet_kill() before freeing wmi in
ath9k_destroy_wmi(). The probe error path already sets stopped and
kills the RX URBs first, so the tasklet cannot be re-armed afterwards.

Fixes: 1af8dc9ca726 ("wifi: ath9k: Clean up device initialisation guards")
Reported-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e91dc13b1b37759b3d9f
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/net/wireless/ath/ath9k/wmi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 4a08babb6d9d..f8b174b0f209 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -122,6 +122,9 @@ void ath9k_stop_wmi(struct ath9k_htc_priv *priv)
 
 void ath9k_destroy_wmi(struct ath9k_htc_priv *priv)
 {
+	struct wmi *wmi = priv->wmi;
+	tasklet_kill(&wmi->wmi_event_tasklet);
+	skb_queue_purge(&wmi->wmi_event_queue);
 	kfree(priv->wmi);
 }
 
@@ -148,6 +151,10 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
 
 	/* Check if ath9k_init_device() completed. */
 	if (!smp_load_acquire(&priv->initialized)) {
+		if (READ_ONCE(wmi->stopped)) {
+			skb_queue_purge(&wmi->wmi_event_queue);
+			return;
+		}
 		tasklet_schedule(t);
 		return;
 	}
-- 
2.43.0