linux-kernel - Re: [PATCH] tty: ipwireless: Fix use-after-free in tasklet during device removal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <777dbdbf.6d6f0.19c3d8b1a1c.Coremail.duoming@zju.edu.cn>
Date: Sun, 8 Feb 2026 21:57:32 +0800 (GMT+08:00)
From: duoming@....edu.cn
To: "Greg KH" <gregkh@...uxfoundation.org>
Cc: linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org,
	jikos@...nel.org, dsterba@...e.com, jirislaby@...nel.org,
	kuba@...nel.org, alexander.deucher@....com,
	akpm@...ux-foundation.org, pkshih@...ltek.com, tglx@...nel.org,
	mingo@...nel.org
Subject: Re: [PATCH] tty: ipwireless: Fix use-after-free in tasklet during
 device removal

On Date: Sun, 8 Feb 2026 12:00:08 +0100 Greg KH wrote:
> > > > When IPWireless PCMCIA card is being detached, the ipw_hardware is
> > > > deallocated in ipwireless_hardware_free(). However, the hw->tasklet may
> > > > still be running or pending, leading to use-after-free bugs when the
> > > > already freed ipw_hardware is accessed again in ipwireless_do_tasklet().
> > > 
> > > Nice, do you have this hardware to test this with?
> > 
> > I don't have the real hardware. In order to reproduce the bug, I simulate 
> > the IPWireless PCMCIA card in the qemu by allocating and configuring the 
> > necessary resources(I/O ports, memory regions, interrupts and so on) to
> > correspond with the hardware expected by the driver in the initialization 
> > code of the virtual device.
> 
> I wonder if this device even is still around, given that pcmcia is all
> but dead for a very long time.
> 
> > > > One race condition scenario is as follows:
> > > > 
> > > > CPU 0 (cleanup)               | CPU 1 (interrupt)
> > > > ipwireless_hardware_free()    | ipwireless_interrupt()
> > > >   ipwireless_stop_interrupts()|   ipwireless_handle_v1_interrupt()
> > > >     do_close_hardware()       |     tasklet_schedule()
> > > >       synchronize_irq()       |
> > > >   kfree(hw) //FREE            | ipwireless_do_tasklet() //handler
> > > >                               |   hw = from_tasklet() //USE
> > > >                               |   hw-> //USE
> > > > 
> > > > Fix this by ensuring hw->tasklet is properly canceled before ipw_hardware
> > > > is released. Add tasklet_kill() in ipwireless_stop_interrupts() to
> > > > synchronize with any pending or running tasklet. Since do_close_hardware()
> > > > could prevent further interrupts, place tasklet_kill() after it to avoid
> > > > the tasklet being rescheduled by ipwireless_interrupt().
> > > 
> > > How was this issue found and tested?
> > 
> > The issue was found by static analysis. I test it through the following steps:
> > 1. Simulating the IPWireless PCMCIA device in the qemu and enable it to trigger interrupts.
> > 2. Controlling the removal and attachment of device via sysfs.
> 
> So this is with the bind/unbind logic, or some other way?  If you are
> unloading the driver, that is something that only root can do, and this
> is a debugging facility, not a "real" way to control drivers and devices
> (yes, the virt drivers abuse this to no end, every time I see this I
> laugh...)

When the PCMCIA device is attached, we can operate the file
/sys/bus/pcmcia/devices/.../remove to detach the device.

> > 3. Triggering interrupts by writing data to device registers via /dev/mem memory mapping
> >    in userspace.
> 
> Interrupts would not happen if the device is removed.  Or is this only
> if the driver is unbound?

The interrupts should be triggered before the deivce is removed.

Best regards,
Duoming Zhou