The ath9k_wmi_event_tasklet() reschedules itself until device initialisation is complete, but if the initialisation fails it is never interrupted. Syzbot triggered a use-after-free in tasklet_action_common because of this. Add a guard to the reschedule logic so it aborts if wmi->stopped is set, and add a call to ath9k_wmi_event_drain() in ath9k_stop_wmi(), so we are sure that the queue is drained and the tasklet is stopped on teardown. Fixes: 1af8dc9ca726 ("wifi: ath9k: Clean up device initialisation guards") Reported-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e91dc13b1b37759b3d9f Tested-by: syzbot+e91dc13b1b37759b3d9f@syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen --- drivers/net/wireless/ath/ath9k/wmi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c index 4a08babb6d9d..c60c8b63623d 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.c +++ b/drivers/net/wireless/ath/ath9k/wmi.c @@ -118,6 +118,8 @@ void ath9k_stop_wmi(struct ath9k_htc_priv *priv) mutex_lock(&wmi->op_mutex); wmi->stopped = true; mutex_unlock(&wmi->op_mutex); + + ath9k_wmi_event_drain(priv); } void ath9k_destroy_wmi(struct ath9k_htc_priv *priv) @@ -148,7 +150,8 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t) /* Check if ath9k_init_device() completed. */ if (!smp_load_acquire(&priv->initialized)) { - tasklet_schedule(t); + if (!READ_ONCE(wmi->stopped)) + tasklet_schedule(t); return; } -- 2.56.0