Re: [PATCH] wifi: ath9k: stop WMI event tasklet from rescheduling itself on probe failure

[Toke Høiland-Jørgensen]

Deepanshu Kartikey <kartikey406@xxxxxxxxx> writes:

> Since the init guards were consolidated, ath9k_wmi_event_tasklet()
> reschedules itself until priv->initialized is set. If
> ath9k_init_device() fails, initialized is never set, so the tasklet
> keeps rescheduling itself while the probe error path calls
> ath9k_destroy_wmi() and frees struct wmi. tasklet_action_common() then
> touches the freed tasklet, causing a slab-use-after-free.
>
> Make the tasklet drop its queued events and stop rescheduling once
> wmi->stopped is set, and call tasklet_kill() before freeing wmi in
> ath9k_destroy_wmi(). The probe error path already sets stopped and
> kills the RX URBs first, so the tasklet cannot be re-armed afterwards.
>
> Fixes: 1af8dc9ca726 ("wifi: ath9k: Clean up device initialisation guards")
> Reported-by: syzbot+e91dc13b1b37759b3d9f@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=e91dc13b1b37759b3d9f
> Tested-by: syzbot+e91dc13b1b37759b3d9f@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>

Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>