[PATCH] wifi: iwlwifi: mld: fix use-after-free in timestamp marker work

[Sicong Huang]

Writing a period to the timestamp_marker debugfs file schedules
fwrt->timestamp.wk without checking whether the firmware is running.
The work tries to send a MARKER_CMD and reschedules itself if the
command was submitted successfully and the period is nonzero.

MLD does not cancel this work when it stops the firmware or tears down
the op mode. iwl_fw_runtime_free() only cancels the firmware dump
works. The work is embedded in struct iwl_fw_runtime, which is part
of struct iwl_mld (hw->priv). So if the work is still pending, it can
run after ieee80211_free_hw() has freed that memory. It then reads
fwrt->timestamp.delay, fwrt->fw and fwrt->trans, may increment
fwrt->timestamp.seq, and may reschedule the freed work. The period is
in seconds while teardown takes milliseconds, so a pending work at
unbind or rmmod time is the normal case, not a narrow race.

MVM already avoids this by calling iwl_fw_cancel_timestamp() when it
stops the device. Do the same in MLD: cancel the work in
iwl_mld_stop_fw() before the firmware is stopped. Also cancel it in
iwl_op_mode_mld_stop() before the memory that embeds it is freed,
because the work can be scheduled even when the firmware is already
stopped.

Signed-off-by: Sicong Huang <congei42@xxxxxxx>
---
 drivers/net/wireless/intel/iwlwifi/mld/fw.c  | 2 ++
 drivers/net/wireless/intel/iwlwifi/mld/mld.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/fw.c b/drivers/net/wireless/intel/iwlwifi/mld/fw.c
index 7b1fb84a641c..ad529f9eb5f1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/fw.c
@@ -355,6 +355,8 @@ void iwl_mld_stop_fw(struct iwl_mld *mld)
 {
 	lockdep_assert_wiphy(mld->wiphy);
 
+	iwl_fw_cancel_timestamp(&mld->fwrt);
+
 	iwl_abort_notification_waits(&mld->notif_wait);
 
 	iwl_fw_dbg_stop_sync(&mld->fwrt);
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mld.c b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
index 6e991fb99ff3..6972846f40af 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mld.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
@@ -519,6 +519,8 @@ iwl_op_mode_mld_stop(struct iwl_op_mode *op_mode)
 
 	ieee80211_unregister_hw(mld->hw);
 
+	iwl_fw_cancel_timestamp(&mld->fwrt);
+
 	iwl_fw_runtime_free(&mld->fwrt);
 	iwl_mld_low_latency_free(mld);
 
-- 
2.34.1