linux-kernel - RE: [PATCH rtw v4 1/4] wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <391e7cc762a549b7826e72090b61ebb2@realtek.com>
Date: Thu, 18 Sep 2025 04:00:09 +0000
From: Ping-Ke Shih <pkshih@...ltek.com>
To: Fedor Pchelkin <pchelkin@...ras.ru>,
        Zong-Zhe Yang
	<kevin_yang@...ltek.com>
CC: Bitterblue Smith <rtl8821cerfe2@...il.com>,
        Bernie Huang
	<phhuang@...ltek.com>,
        "linux-wireless@...r.kernel.org"
	<linux-wireless@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "lvc-project@...uxtesting.org"
	<lvc-project@...uxtesting.org>,
        "stable@...r.kernel.org"
	<stable@...r.kernel.org>
Subject: RE: [PATCH rtw v4 1/4] wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()

Fedor Pchelkin <pchelkin@...ras.ru> wrote:

[...]

> @@ -6181,6 +6187,27 @@ rtw89_assoc_link_rcu_dereference(struct rtw89_dev *rtwdev, u8 macid)
>         list_first_entry_or_null(&p->dlink_pool, typeof(*p->links_inst), dlink_schd); \
>  })
> 
> +static inline void rtw89_tx_wait_release(struct rtw89_tx_wait_info *wait)
> +{
> +       dev_kfree_skb_any(wait->skb);
> +       kfree_rcu(wait, rcu_head);
> +}
> +
> +static inline void rtw89_tx_wait_list_clear(struct rtw89_dev *rtwdev)
> +{
> +       struct rtw89_tx_wait_info *wait, *tmp;
> +
> +       lockdep_assert_wiphy(rtwdev->hw->wiphy);
> +
> +       list_for_each_entry_safe(wait, tmp, &rtwdev->tx_waits, list) {
> +               if (!wait_for_completion_timeout(&wait->completion,
> +                                                RTW89_TX_WAIT_DEFAULT_TIMEOUT))
> +                       continue;


Why should we wait 10ms? Just try_wait_for_completion()?

Since TX completion might be missing (rtw89_core_stop(), for example), 
shouldn't we unconditionally free all in wait list for that case?


> +               list_del(&wait->list);
> +               rtw89_tx_wait_release(wait);
> +       }
> +}
> +
>  static inline int rtw89_hci_tx_write(struct rtw89_dev *rtwdev,
>                                      struct rtw89_core_tx_request *tx_req)
>  {