[BUG] KASAN: use-after-free in rtw_load_firmware_cb (rtw88) — async firmware callback after device probe failure / rtw_dev freed [rtw88_8812au] [syzkaller]

[Yang Zi]

Hi,

While fuzzing kernel v7.1 with syzkaller, a driver rtw88_8812au
tripped a use-after-free in the asynchronous firmware-load callback.

Reproducer summary (attached report/log):

    rtw88_8812au 1-1:1.0: IN pipes overflow
    rtw88_8812au 1-1:1.0: failed to init USB interface
    rtw88_8812au 1-1:1.0: probe with driver rtw88_8812au failed with error -22
    BUG: KASAN: use-after-free in rtw_load_firmware_cb+0x2538/0x2d80 drivers/net/wireless/realtek/rtw88/main.c:1822 [rtw88_core]
    Read of size 2 ... by task kworker/0:2/46
    Workqueue: events request_firmware_work_func

The reading task is a firmware-async worker; the target physical page was
already returned to buddy (refcount:0, mapcount:0, contents `ff`).

Root-cause hypothesis: `rtw_load_firmware()` passes `fw` (which holds a
pointer to `rtw_dev`) to `request_firmware_nowait()`. On a USB probe-failure
cycle (`IN pipes overflow` → error -22), the driver removes /frees `rtw_dev`
(and its embedded `rtw_fw_state`). But the already-queued `request_firmware_work`
runs later and `rtw_load_firmware_cb` dereferences the now-freed `rtw_dev->hw`
(and wiphy) — a read-on-freed-object UAF. There is no reference count keeping
the async firmware request alive with the device, and remove does not cancel a
pending firmware work.

The crash report attached below:

rtw88_8821au 1-1:1.0: IN pipes overflow
rtw88_8821au 1-1:1.0: failed to init USB interface
rtw88_8821au 1-1:1.0: probe with driver rtw88_8821au failed with error -22
==================================================================
BUG: KASAN: use-after-free in rtw_load_firmware_cb+0x2538/0x2d80 drivers/net/wireless/realtek/rtw88/main.c:1822 [rtw88_core]
Read of size 2 at addr ffff888015dd9848 by task kworker/0:2/46

CPU: 0 UID: 0 PID: 46 Comm: kworker/0:2 Tainted: G        W  O        7.1.0 #1 PREEMPT(lazy) 
Tainted: [W]=WARN, [O]=OOT_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 dump_stack_lvl+0xa2/0xd0 lib/dump_stack.c:120
 print_address_description+0x77/0x200 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 rtw_load_firmware_cb+0x2538/0x2d80 drivers/net/wireless/realtek/rtw88/main.c:1822 [rtw88_core]
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15dd9
flags: 0x100000000000000(node=0|zone=1)
raw: 0100000000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888015dd9700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888015dd9780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888015dd9800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff888015dd9880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888015dd9900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
usbcore: registered new interface driver rtw88_8821au
modprobe (1122) used greatest stack depth: 20080 bytes left
usb 1-1:1.0: Firmware version 42.4.0, H2C version 0

<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

Regards,
Yang Zi