In cc2520_probe()'s err_hw_init path, mutex_destroy(&priv->buffer_mutex)
is called before flush_work(&priv->fifop_irqwork). If fifop_irq fires
after devm_request_irq() and schedules priv->fifop_irqwork before probe
fails, cc2520_fifop_irqwork() can lock priv->buffer_mutex after it has
already been destroyed:
BUG: KASAN: slab-use-after-free in assign_work+0x2f1/0x340
Read of size 8 at addr ffff88800246b0b0 by task kworker/1:1/43
Workqueue: 0x0 (events)
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
assign_work+0x2f1/0x340
worker_thread+0x2b8/0xb70
Flush priv->fifop_irqwork before mutex_destroy(&priv->buffer_mutex),
matching the teardown order in cc2520_remove().
Tested in QEMU with KASAN enabled by scheduling fifop_irqwork on the
cc2520_probe() error path.
Fixes: ff5891b266a7 ("ieee802154: cc2520: fix FIFOP work use-after-free")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
Changes in v2:
- Split out as patch 2/4 and documented the probe cleanup ordering fix and
Fixes: tag as requested by Miquel Raynal.
drivers/net/ieee802154/cc2520.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
index 5454872..d2c8484 100644
--- a/drivers/net/ieee802154/cc2520.c
+++ b/drivers/net/ieee802154/cc2520.c
@@ -1153,8 +1153,8 @@ static int cc2520_probe(struct spi_device *spi)
return 0;
err_hw_init:
- mutex_destroy(&priv->buffer_mutex);
flush_work(&priv->fifop_irqwork);
+ mutex_destroy(&priv->buffer_mutex);
return ret;
}
--
2.47.3
