[PATCH] tty: ipwireless: Fix use-after-free in tasklet during device removal

[Duoming Zhou]

When IPWireless PCMCIA card is being detached, the ipw_hardware is
deallocated in ipwireless_hardware_free(). However, the hw->tasklet may
still be running or pending, leading to use-after-free bugs when the
already freed ipw_hardware is accessed again in ipwireless_do_tasklet().

One race condition scenario is as follows:

CPU 0 (cleanup)               | CPU 1 (interrupt)
ipwireless_hardware_free()    | ipwireless_interrupt()
  ipwireless_stop_interrupts()|   ipwireless_handle_v1_interrupt()
    do_close_hardware()       |     tasklet_schedule()
      synchronize_irq()       |
  kfree(hw) //FREE            | ipwireless_do_tasklet() //handler
                              |   hw = from_tasklet() //USE
                              |   hw-> //USE

Fix this by ensuring hw->tasklet is properly canceled before ipw_hardware
is released. Add tasklet_kill() in ipwireless_stop_interrupts() to
synchronize with any pending or running tasklet. Since do_close_hardware()
could prevent further interrupts, place tasklet_kill() after it to avoid
the tasklet being rescheduled by ipwireless_interrupt().

Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
---
 drivers/tty/ipwireless/hardware.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
index e18848267be..c736cba751f 100644
--- a/drivers/tty/ipwireless/hardware.c
+++ b/drivers/tty/ipwireless/hardware.c
@@ -1725,6 +1725,7 @@ void ipwireless_stop_interrupts(struct ipw_hardware *hw)
 
 		/* Prevent the hardware from sending any more interrupts */
 		do_close_hardware(hw);
+		tasklet_kill(&hw->tasklet);
 	}
 }
 
-- 
2.34.1