linux-kernel - RE: [PATCH rtw v2 1/4] wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <da4e555fb0e6404386a5b18f17dbc296@realtek.com>
Date: Fri, 29 Aug 2025 03:02:47 +0000
From: Zong-Zhe Yang <kevin_yang@...ltek.com>
To: "pchelkin@...ras.ru" <pchelkin@...ras.ru>
CC: Ping-Ke Shih <pkshih@...ltek.com>, Bernie Huang <phhuang@...ltek.com>,
        "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "lvc-project@...uxtesting.org" <lvc-project@...uxtesting.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH rtw v2 1/4] wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()

Fedor Pchelkin <pchelkin@...ras.ru> wrote:
> 
> Thanks! I agree with all aforementioned comments but wonder about this one:
> 
> On Thu, 28. Aug 08:07, Zong-Zhe Yang wrote:
> > Fedor Pchelkin <pchelkin@...ras.ru> wrote:
> > > --- a/drivers/net/wireless/realtek/rtw89/pci.c
> > > +++ b/drivers/net/wireless/realtek/rtw89/pci.c
> > > @@ -464,10 +464,7 @@ static void rtw89_pci_tx_status(struct rtw89_dev *rtwdev,
> > >     struct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb);
> > >     struct ieee80211_tx_info *info;
> > >
> > > -   rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status == RTW89_TX_DONE);
> > > -
> > >     info = IEEE80211_SKB_CB(skb);
> > > -   ieee80211_tx_info_clear_status(info);
> > >
> > >     if (info->flags & IEEE80211_TX_CTL_NO_ACK)
> > >             info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
> > > @@ -494,6 +491,10 @@ static void rtw89_pci_tx_status(struct rtw89_dev *rtwdev,
> > >             }
> > >     }
> > >
> > > +   if (rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status == RTW89_TX_DONE))
> > > +           return;
> > > +
> > > +   ieee80211_tx_info_clear_status(info);
> >
> > Don't change order of these calls.
> > (it's wrong for normal pkt because their tx_info are cleared after
> > filled)
> >
> 
> ieee80211_tx_info_clear_status() clears only TX status part of the ieee80211_tx_info. It
> doesn't touch 'flags' field - the only one filled here by rtw89_pci_tx_status(). It shouldn't be
> wrong for normal packets.
> 

I double checked it again and think you are right.
I misread tx_info->flags against tx_info->status.flags.
Sorry.

> The reason for changing the order of those calls is to have a chance to update tx_ring
> statistics before fast return from rtw89_pci_tx_status() in case of tx_wait packets.
> 
> But, ergh, I can't find those stats reported anywhere in the driver so it looks like just not a real
> issue currently and I'd rather not change the order, okay.
> 

These statistics are used when debugging normal packets from stack.
For driver packets (with tx wait), I think top callers, e.g. rtw89_core_send_nullfunc,
will warns when tx failed. So, don't care these statistics.

> > >     ieee80211_tx_status_ni(rtwdev->hw, skb);  }
> > >