Re: [PATCH] wifi: rsi: fix kthread lifetime race between self-exit and external-stop

[Hillf Danton]

On Thu, 23 Apr 2026 02:38:46 +0900 Jeongjun Park wrote:
> RSI driver use both self-exit(kthread_complete_and_exit) and external-stop
> (kthread_stop) when killing a kthread. Generally, kthread_stop() is called
> first, and in this case, no particular issues occur.
>
> However, in rare instances where kthread_complete_and_exit() is called
> first and then kthread_stop() is called, a UAF occurs because the kthread
> object, which has already exited and been freed, is accessed again.
>
Alternatively the race could be described with the regular diagram to better
understand the uaf.

rsi_kill_thread() rsi_tx_scheduler_thread()
--- ---
atomic_inc(&handle->thread_done); // set the done flag
rsi_set_event(&handle->event);

do {
something;
} while (atomic_read(&common->tx_thread.thread_done) == 0);
// exit after done
kthread_complete_and_exit(&common->tx_thread.completion, 0);

kthread_stop(handle->task); // uaf

> Therefore, to prevent this with minimal modification, you must remove
> kthread_stop() and change the code to wait until the self-exit operation
> is completed.
>
> Cc: <sta...@vger.kernel.org>
> Reported-by: syzbot+5de83f...@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/69e5d03b.a00a022...@google.com/
> Fixes: 4c62764d0fc2 ("rsi: improve kernel thread handling to fix kernel panic")
> Signed-off-by: Jeongjun Park <aha3...@gmail.com>
> ---
> drivers/net/wireless/rsi/rsi_common.h | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/rsi/rsi_common.h b/drivers/net/wireless/rsi/rsi_common.h
> index 591602beeec6..3cdf9ded876d 100644
> --- a/drivers/net/wireless/rsi/rsi_common.h
> +++ b/drivers/net/wireless/rsi/rsi_common.h
> @@ -70,12 +70,11 @@ static inline int rsi_create_kthread(struct rsi_common *common,
> return 0;
> }
>
> -static inline int rsi_kill_thread(struct rsi_thread *handle)
> +static inline void rsi_kill_thread(struct rsi_thread *handle)
> {
> atomic_inc(&handle->thread_done);
> rsi_set_event(&handle->event);
> -
> - return kthread_stop(handle->task);
> + wait_for_completion(&handle->completion);
> }
>
> void rsi_mac80211_detach(struct rsi_hw *hw);
> --
>