Jeongjun ParkandGreg Kroah-Hartman 16d9f674c6 wifi: rsi: fix kthread lifetime race between self-exit and external-stop ...

commit db57a1aa54 upstream.

RSI driver use both self-exit(kthread_complete_and_exit) and external-stop
(kthread_stop) when killing a kthread. Generally, kthread_stop() is called
first, and in this case, no particular issues occur.

However, in rare instances where kthread_complete_and_exit() is called
first and then kthread_stop() is called, a UAF occurs because the kthread
object, which has already exited and been freed, is accessed again.

Therefore, to prevent this with minimal modification, you must remove
kthread_stop() and change the code to wait until the self-exit operation
is completed.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+5de83f57cd8531f55596@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69e5d03b.a00a0220.1bd0ca.0064.GAE@google.com/
Fixes: 4c62764d0f ("rsi: improve kernel thread handling to fix kernel panic")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Link: https://patch.msgid.link/20260422173846.37640-1-aha310510@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-05-14 15:29:19 +02:00

..

Kconfig

…

Makefile

…

rsi_91x_coex.c

…

rsi_91x_core.c

…

rsi_91x_debugfs.c

…

rsi_91x_hal.c

…

rsi_91x_mac80211.c

…

rsi_91x_main.c

…

rsi_91x_mgmt.c

…

rsi_91x_ps.c

…

rsi_91x_sdio_ops.c

…

rsi_91x_sdio.c

…

rsi_91x_usb_ops.c

…

rsi_91x_usb.c

…

rsi_boot_params.h

…

rsi_coex.h

…

rsi_common.h

wifi: rsi: fix kthread lifetime race between self-exit and external-stop

2026-05-14 15:29:19 +02:00

rsi_debugfs.h

…

rsi_hal.h

…

rsi_main.h

…

rsi_mgmt.h

…

rsi_ps.h

…

rsi_sdio.h

…

rsi_usb.h

…