[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <874k1ocvq1.fsf@toke.dk>
Date: Tue, 17 May 2022 12:13:58 +0200
From: Toke Høiland-Jørgensen <toke@...e.dk>
To: Pavel Skripkin <paskripkin@...il.com>, kvalo@...nel.org,
davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com
Cc: linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org,
Pavel Skripkin <paskripkin@...il.com>,
syzbot+03110230a11411024147@...kaller.appspotmail.com,
syzbot+c6dde1f690b60e0b9fbe@...kaller.appspotmail.com
Subject: Re: [PATCH v4 1/2] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Pavel Skripkin <paskripkin@...il.com> writes:
> Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
> problem was in incorrect htc_handle->drv_priv initialization.
>
> Probable call trace which can trigger use-after-free:
>
> ath9k_htc_probe_device()
> /* htc_handle->drv_priv = priv; */
> ath9k_htc_wait_for_target() <--- Failed
> ieee80211_free_hw() <--- priv pointer is freed
>
> <IRQ>
> ...
> ath9k_hif_usb_rx_cb()
> ath9k_hif_usb_rx_stream()
> RX_STAT_INC() <--- htc_handle->drv_priv access
>
> In order to not add fancy protection for drv_priv we can move
> htc_handle->drv_priv initialization at the end of the
> ath9k_htc_probe_device() and add helper macro to make
> all *_STAT_* macros NULL save, since syzbot has reported related NULL
s/save/safe here as well :)
-Toke
Powered by blists - more mailing lists