linux-kernel - [PATCH] tty: ipwireless: Fix use-after-free in tasklet during device removal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260208062538.29608-1-duoming@zju.edu.cn>
Date: Sun,  8 Feb 2026 14:25:38 +0800
From: Duoming Zhou <duoming@....edu.cn>
To: linux-serial@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,
	jikos@...nel.org,
	dsterba@...e.com,
	gregkh@...uxfoundation.org,
	jirislaby@...nel.org,
	kuba@...nel.org,
	alexander.deucher@....com,
	akpm@...ux-foundation.org,
	pkshih@...ltek.com,
	tglx@...nel.org,
	mingo@...nel.org,
	Duoming Zhou <duoming@....edu.cn>
Subject: [PATCH] tty: ipwireless: Fix use-after-free in tasklet during device removal

When IPWireless PCMCIA card is being detached, the ipw_hardware is
deallocated in ipwireless_hardware_free(). However, the hw->tasklet may
still be running or pending, leading to use-after-free bugs when the
already freed ipw_hardware is accessed again in ipwireless_do_tasklet().

One race condition scenario is as follows:

CPU 0 (cleanup)               | CPU 1 (interrupt)
ipwireless_hardware_free()    | ipwireless_interrupt()
  ipwireless_stop_interrupts()|   ipwireless_handle_v1_interrupt()
    do_close_hardware()       |     tasklet_schedule()
      synchronize_irq()       |
  kfree(hw) //FREE            | ipwireless_do_tasklet() //handler
                              |   hw = from_tasklet() //USE
                              |   hw-> //USE

Fix this by ensuring hw->tasklet is properly canceled before ipw_hardware
is released. Add tasklet_kill() in ipwireless_stop_interrupts() to
synchronize with any pending or running tasklet. Since do_close_hardware()
could prevent further interrupts, place tasklet_kill() after it to avoid
the tasklet being rescheduled by ipwireless_interrupt().

Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
Signed-off-by: Duoming Zhou <duoming@....edu.cn>
---
 drivers/tty/ipwireless/hardware.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
index e18848267be..c736cba751f 100644
--- a/drivers/tty/ipwireless/hardware.c
+++ b/drivers/tty/ipwireless/hardware.c
@@ -1725,6 +1725,7 @@ void ipwireless_stop_interrupts(struct ipw_hardware *hw)
 
 		/* Prevent the hardware from sending any more interrupts */
 		do_close_hardware(hw);
+		tasklet_kill(&hw->tasklet);
 	}
 }
 
-- 
2.34.1