Ping-Ke Shih <pkshih@xxxxxxxxxxx> wrote: > request_firmware_nowait() which schedules another work is used to load > firmware when USB is probing. If USB is unplugged before running the > firmware work, it goes disconnect ops, and then causes use-after-free. > Though we wait for completion of firmware work before freeing the hw, > firmware callback rises completion too early. So I move it to the > last step. > > usb 5-1: Direct firmware load for rtlwifi/rtl8192cufw.bin failed with error -2 > rtlwifi: Loading alternative firmware rtlwifi/rtl8192cufw.bin > rtlwifi: Selected firmware is not available > ================================================================== > BUG: KASAN: use-after-free in rtl_fw_do_work.cold+0x68/0x6a drivers/net/wireless/realtek/rtlwifi/core.c:93 > Write of size 4 at addr ffff8881454cff50 by task kworker/0:6/7379 > > CPU: 0 PID: 7379 Comm: kworker/0:6 Not tainted 5.10.0-rc7-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Workqueue: events request_firmware_work_func > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x107/0x163 lib/dump_stack.c:118 > print_address_description.constprop.0.cold+0xae/0x4c8 mm/kasan/report.c:385 > __kasan_report mm/kasan/report.c:545 [inline] > kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562 > rtl_fw_do_work.cold+0x68/0x6a drivers/net/wireless/realtek/rtlwifi/core.c:93 > request_firmware_work_func+0x12c/0x230 drivers/base/firmware_loader/main.c:1079 > process_one_work+0x933/0x1520 kernel/workqueue.c:2272 > worker_thread+0x64c/0x1120 kernel/workqueue.c:2418 > kthread+0x38c/0x460 kernel/kthread.c:292 > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 > > The buggy address belongs to the page: > page:00000000f54435b3 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1454cf > flags: 0x200000000000000() > raw: 0200000000000000 0000000000000000 ffffea00051533c8 0000000000000000 > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff8881454cfe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ffff8881454cfe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > >ffff8881454cff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ^ > ffff8881454cff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ffff8881454d0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > > Reported-by: syzbot+65be4277f3c489293939@xxxxxxxxxxxxxxxxxxxxxxxxx > Signed-off-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx> Patch applied to wireless-drivers.git, thanks. 4dfde294b979 rtlwifi: rise completion at the last step of firmware callback -- https://patchwork.kernel.org/project/linux-wireless/patch/20201214053106.7748-1-pkshih@xxxxxxxxxxx/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
