linux-kernel - [PATCH] wifi: rtlwifi: rtl delayed work must be canceled before putting usb dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20241012144216.433013-1-lizhi.xu@windriver.com>
Date: Sat, 12 Oct 2024 22:42:16 +0800
From: Lizhi Xu <lizhi.xu@...driver.com>
To: <syzbot+90f31ac02b7ae5e8b578@...kaller.appspotmail.com>
CC: <akpm@...ux-foundation.org>, <linux-kernel@...r.kernel.org>,
        <linux-usb@...r.kernel.org>, <syzkaller-bugs@...glegroups.com>,
        <tglx@...utronix.de>
Subject: [PATCH] wifi: rtlwifi: rtl delayed work must be canceled before putting usb dev

rtl delayed work not be canceled before put usb device, it trigger following issue:
ODEBUG: free active (active state 0) object: ffff88811dc037c8 object type: timer_list hint: rtl_ips_nic_off_wq_callback+0x0/0x680
[  135.350453][    C1] RIP: 0010:debug_print_object+0x1a3/0x2b0
[  135.350498][    C1] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 48 8b 14 dd c0 fc 46 87 41 56 4c 89 e6 48 c7 c7 20 f0 46 87 e8 2e d5 c3 fe 90 <0f> 0b 90 90 58 83 05 ad 76 ff 07 01 48 83 c4 18 5b 5d 41 5c 41 5d
[  135.350532][    C1] RSP: 0018:ffffc90001adf418 EFLAGS: 00010282
[  135.350562][    C1] RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff811ab159
[  135.350585][    C1] RDX: ffff88811c061d40 RSI: ffffffff811ab166 RDI: 0000000000000001
[  135.350609][    C1] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
[  135.350631][    C1] R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8746f6c0
[  135.350654][    C1] R13: ffffffff872a8e00 R14: ffffffff840306a0 R15: ffffc90001adf528
[  135.351009][    C1]  debug_check_no_obj_freed+0x4b8/0x600
[  135.351194][    C1]  __free_pages_ok+0x244/0xa20
[  135.351262][    C1]  __folio_put+0x1cd/0x250
[  135.351527][    C1]  device_release+0xa1/0x240
[  135.351576][    C1]  kobject_put+0x1e4/0x5a0
[  135.351624][    C1]  put_device+0x1f/0x30
[  135.351669][    C1]  rtl_usb_disconnect+0x41c/0x5a0
[  135.351720][    C1]  usb_unbind_interface+0x1e8/0x970
[  135.351859][    C1]  device_remove+0x122/0x170
[  135.351895][    C1]  device_release_driver_internal+0x44a/0x610
[  135.351944][    C1]  bus_remove_device+0x22f/0x420
[  135.352003][    C1]  device_del+0x396/0x9f0
[  135.352138][    C1]  usb_disable_device+0x36c/0x7f0
[  135.352202][    C1]  usb_disconnect+0x2e1/0x920
[  135.352264][    C1]  hub_event+0x1bed/0x4f40
[  135.352778][    C1]  process_one_work+0x9c5/0x1ba0
[  135.353023][    C1]  worker_thread+0x6c8/0xf00
[  135.353193][    C1]  kthread+0x2c1/0x3a0
[  135.353313][    C1]  ret_from_fork+0x45/0x80
[  135.353406][    C1]  ret_from_fork_asm+0x1a/0x30
[  135.353474][    C1]  </TASK>

By moving the position of rtl_deinit_deferred_work() in rtl_usb_disconnect(),
ensure that rtl_deinit_deferred_work() is executed before releasing the USB
device. In addition, add a bit in "enum ttl_status" to indicate whether
rtl_deinit_deferred_work() needs to be executed. It needs to be executed when
set, otherwise it will not be executed.

Reported-and-tested-by: syzbot+90f31ac02b7ae5e8b578@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=90f31ac02b7ae5e8b578
Signed-off-by: Lizhi Xu <lizhi.xu@...driver.com>
---
 drivers/net/wireless/realtek/rtlwifi/base.c | 5 +++++
 drivers/net/wireless/realtek/rtlwifi/usb.c  | 2 +-
 drivers/net/wireless/realtek/rtlwifi/wifi.h | 1 +
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index aab4605de9c4..605875d21573 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -449,6 +449,7 @@ static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
 	if (!wq)
 		return -ENOMEM;
 
+	set_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status);
 	/* <1> timer */
 	timer_setup(&rtlpriv->works.watchdog_timer,
 		    rtl_watch_dog_timer_callback, 0);
@@ -473,6 +474,9 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 
+	if (!test_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status))
+		return;
+
 	del_timer_sync(&rtlpriv->works.watchdog_timer);
 
 	cancel_delayed_work_sync(&rtlpriv->works.watchdog_wq);
@@ -484,6 +488,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
 	cancel_delayed_work_sync(&rtlpriv->works.ps_rfon_wq);
 	cancel_delayed_work_sync(&rtlpriv->works.fwevt_wq);
 	cancel_delayed_work_sync(&rtlpriv->works.c2hcmd_wq);
+	clear_bit(RTL_STATUS_WORK_SETUP, &rtlpriv->status);
 }
 EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index d37a017b2b81..aaa16bc23e91 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1064,9 +1064,9 @@ void rtl_usb_disconnect(struct usb_interface *intf)
 		ieee80211_unregister_hw(hw);
 		rtlmac->mac80211_registered = 0;
 	} else {
-		rtl_deinit_deferred_work(hw, false);
 		rtlpriv->intf_ops->adapter_stop(hw);
 	}
+	rtl_deinit_deferred_work(hw, false);
 	/*deinit rfkill */
 	/* rtl_deinit_rfkill(hw); */
 	rtl_usb_deinit(hw);
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index ae6e351bc83c..24d3dcbdf81c 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -322,6 +322,7 @@ enum rt_eeprom_type {
 
 enum ttl_status {
 	RTL_STATUS_INTERFACE_START = 0,
+	RTL_STATUS_WORK_SETUP = 1,
 };
 
 enum hardware_type {
-- 
2.43.0