Forwarded: Re: [syzbot] [wireless?] KASAN: slab-use-after-free Read in tasklet_action_common

[syzbot <syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [wireless?] KASAN: slab-use-after-free Read in tasklet_action_common
Author: toke@toke.dk

#syz test

diff --git i/drivers/net/wireless/ath/ath9k/wmi.c w/drivers/net/wireless/ath/ath9k/wmi.c
index 4a08babb6d9d..a7cdb6b29cdc 100644
--- i/drivers/net/wireless/ath/ath9k/wmi.c
+++ w/drivers/net/wireless/ath/ath9k/wmi.c
@@ -111,20 +111,6 @@ struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv)
 	return wmi;
 }
 
-void ath9k_stop_wmi(struct ath9k_htc_priv *priv)
-{
-	struct wmi *wmi = priv->wmi;
-
-	mutex_lock(&wmi->op_mutex);
-	wmi->stopped = true;
-	mutex_unlock(&wmi->op_mutex);
-}
-
-void ath9k_destroy_wmi(struct ath9k_htc_priv *priv)
-{
-	kfree(priv->wmi);
-}
-
 void ath9k_wmi_event_drain(struct ath9k_htc_priv *priv)
 {
 	unsigned long flags;
@@ -135,6 +121,22 @@ void ath9k_wmi_event_drain(struct ath9k_htc_priv *priv)
 	spin_unlock_irqrestore(&priv->wmi->wmi_lock, flags);
 }
 
+void ath9k_stop_wmi(struct ath9k_htc_priv *priv)
+{
+	struct wmi *wmi = priv->wmi;
+
+	mutex_lock(&wmi->op_mutex);
+	wmi->stopped = true;
+	mutex_unlock(&wmi->op_mutex);
+
+	ath9k_wmi_event_drain(priv);
+}
+
+void ath9k_destroy_wmi(struct ath9k_htc_priv *priv)
+{
+	kfree(priv->wmi);
+}
+
 void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
 {
 	struct wmi *wmi = from_tasklet(wmi, t, wmi_event_tasklet);
@@ -148,7 +150,8 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
 
 	/* Check if ath9k_init_device() completed. */
 	if (!smp_load_acquire(&priv->initialized)) {
-		tasklet_schedule(t);
+		if (!READ_ONCE(wmi->stopped))
+			tasklet_schedule(t);
 		return;
 	}