linux-kernel - [PATCH] brcmfmac: btcoex: Fix use-after-free when rescheduling brcmf_btcoex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250821043202.21263-1-duoming@zju.edu.cn>
Date: Thu, 21 Aug 2025 12:32:02 +0800
From: Duoming Zhou <duoming@....edu.cn>
To: brcm80211@...ts.linux.dev
Cc: brcm80211-dev-list.pdl@...adcom.com,
	linux-kernel@...r.kernel.org,
	linux-wireless@...r.kernel.org,
	mingo@...nel.org,
	tglx@...utronix.de,
	arend.vanspriel@...adcom.com,
	Duoming Zhou <duoming@....edu.cn>
Subject: [PATCH] brcmfmac: btcoex: Fix use-after-free when rescheduling brcmf_btcoex_info work

The brcmf_btcoex_detach() only shuts down the btcoex timer, if the
flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which
runs as timer handler, sets timer_on to false. This creates a critical
race condition:

1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()
is executing, it may observe timer_on as false and skip the call to
timer_shutdown_sync().

2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info
worker after the cancel_work_sync() has been executed.

3.Subsequently, the brcmf_btcoex_info structure is freed.

4.Finally, the rescheduled worker attempts to execute, leading to
use-after-free bugs by accessing the freed brcmf_btcoex_info object.

The following diagram illustrates this sequence of events:

cpu0                            cpu1
brcmf_btcoex_detach          |  brcmf_btcoex_timerfunc
                             |    bt_local->timer_on = false;
  if (cfg->btcoex->timer_on) |
    ...                      |
  cancel_work_sync();        |
  ...                        |    schedule_work() //reschedule
  kfree(cfg->btcoex);//free  |
                             |    brcmf_btcoex_handler() //worker
                             |    btci-> //use

To resolve this race condition, drop the conditional check and call
timer_shutdown_sync() directly. It can deactivate the timer reliably,
regardless of its current state. Once stopped, the timer_on state is
then set to false.

Fixes: 61730d4dfffc ("brcmfmac: support critical protocol API for DHCP")
Signed-off-by: Duoming Zhou <duoming@....edu.cn>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
index 69ef8cf203d2..67c0c5a92f99 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
@@ -393,10 +393,8 @@ void brcmf_btcoex_detach(struct brcmf_cfg80211_info *cfg)
 	if (!cfg->btcoex)
 		return;

-	if (cfg->btcoex->timer_on) {
-		cfg->btcoex->timer_on = false;
-		timer_shutdown_sync(&cfg->btcoex->timer);
-	}
+	timer_shutdown_sync(&cfg->btcoex->timer);
+	cfg->btcoex->timer_on = false;

 	cancel_work_sync(&cfg->btcoex->work);

-- 
2.34.1