• Zheyu Ma's avatar
    mwl8k: Fix use-after-free in mwl8k_fw_state_machine() · 257051a2
    Zheyu Ma authored
    When the driver fails to request the firmware, it calls its error
    handler. In the error handler, the driver detaches device from driver
    first before releasing the firmware, which can cause a use-after-free bug.
    
    Fix this by releasing firmware first.
    
    The following log reveals it:
    
    [    9.007301 ] BUG: KASAN: use-after-free in mwl8k_fw_state_machine+0x320/0xba0
    [    9.010143 ] Workqueue: events request_firmware_work_func
    [    9.010830 ] Call Trace:
    [    9.010830 ]  dump_stack_lvl+0xa8/0xd1
    [    9.010830 ]  print_address_description+0x87/0x3b0
    [    9.010830 ]  kasan_report+0x172/0x1c0
    [    9.010830 ]  ? mutex_unlock+0xd/0x10
    [    9.010830 ]  ? mwl8k_fw_state_machine+0x320/0xba0
    [    9.010830 ]  ? mwl8k_fw_state_machine+0x320/0xba0
    [    9.010830 ]  __asan_report_load8_noabort+0x14/0x20
    [    9.010830 ]  mwl8k_fw_state_machine+0x320/0xba0
    [    9.010830 ]  ? mwl8k_load_firmware+0x5f0/0x5f0
    [    9.010830 ]  request_firmware_work_func+0x172/0x250
    [    9.010830 ]  ? read_lock_is_recursive+0x20/0x20
    [    9.010830 ]  ? process_one_work+0x7a1/0x1100
    [    9.010830 ]  ? request_firmware_nowait+0x460/0x460
    [    9.010830 ]  ? __this_cpu_preempt_check+0x13/0x20
    [    9.010830 ]  process_one_work+0x9bb/0x1100
    Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/1634356979-6211-1-git-send-email-zheyuma97@gmail.com
    257051a2
mwl8k.c 154 KB