RSI driver use both self-exit(kthread_complete_and_exit) and external-stop
(kthread_stop) when killing a kthread. Generally, kthread_stop() is called
first, and in this case, no particular issues occur.

However, in rare instances where kthread_complete_and_exit() is called
first and then kthread_stop() is called, a UAF occurs because the kthread
object, which has already exited and been freed, is accessed again.

Therefore, to prevent this with minimal modification, you must remove
kthread_stop() and change the code to wait until the self-exit operation
is completed.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+5de83f57cd8531f55596@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69e5d03b.a00a0220.1bd0ca.0064.GAE@google.com/
Fixes: 4c62764d0fc2 ("rsi: improve kernel thread handling to fix kernel panic")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
---
 drivers/net/wireless/rsi/rsi_common.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_common.h b/drivers/net/wireless/rsi/rsi_common.h
index 591602beeec6..3cdf9ded876d 100644
--- a/drivers/net/wireless/rsi/rsi_common.h
+++ b/drivers/net/wireless/rsi/rsi_common.h
@@ -70,12 +70,11 @@ static inline int rsi_create_kthread(struct rsi_common *common,
 	return 0;
 }
 
-static inline int rsi_kill_thread(struct rsi_thread *handle)
+static inline void rsi_kill_thread(struct rsi_thread *handle)
 {
 	atomic_inc(&handle->thread_done);
 	rsi_set_event(&handle->event);
-
-	return kthread_stop(handle->task);
+	wait_for_completion(&handle->completion);
 }
 
 void rsi_mac80211_detach(struct rsi_hw *hw);
--

On Thu, 23 Apr 2026 02:38:46 +0900 Jeongjun Park wrote:
> RSI driver use both self-exit(kthread_complete_and_exit) and external-stop
> (kthread_stop) when killing a kthread. Generally, kthread_stop() is called
> first, and in this case, no particular issues occur.
> 
> However, in rare instances where kthread_complete_and_exit() is called
> first and then kthread_stop() is called, a UAF occurs because the kthread
> object, which has already exited and been freed, is accessed again.
> 
Alternatively the race could be described with the regular diagram to better
understand the uaf.

	rsi_kill_thread()	rsi_tx_scheduler_thread()
	---			---
	atomic_inc(&handle->thread_done); // set the done flag
 	rsi_set_event(&handle->event);

				do {
					something;
				} while (atomic_read(&common->tx_thread.thread_done) == 0);
				// exit after done
				kthread_complete_and_exit(&common->tx_thread.completion, 0);

	kthread_stop(handle->task); // uaf

> Therefore, to prevent this with minimal modification, you must remove
> kthread_stop() and change the code to wait until the self-exit operation
> is completed.
> 
> Cc: <stable@vger.kernel.org>
> Reported-by: syzbot+5de83f57cd8531f55596@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/69e5d03b.a00a0220.1bd0ca.0064.GAE@google.com/
> Fixes: 4c62764d0fc2 ("rsi: improve kernel thread handling to fix kernel panic")
> Signed-off-by: Jeongjun Park <aha310510@gmail.com>
> ---
>  drivers/net/wireless/rsi/rsi_common.h | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/wireless/rsi/rsi_common.h b/drivers/net/wireless/rsi/rsi_common.h
> index 591602beeec6..3cdf9ded876d 100644
> --- a/drivers/net/wireless/rsi/rsi_common.h
> +++ b/drivers/net/wireless/rsi/rsi_common.h
> @@ -70,12 +70,11 @@ static inline int rsi_create_kthread(struct rsi_common *common,
>  	return 0;
>  }
>  
> -static inline int rsi_kill_thread(struct rsi_thread *handle)
> +static inline void rsi_kill_thread(struct rsi_thread *handle)
>  {
>  	atomic_inc(&handle->thread_done);
>  	rsi_set_event(&handle->event);
> -
> -	return kthread_stop(handle->task);
> +	wait_for_completion(&handle->completion);
>  }
>  
>  void rsi_mac80211_detach(struct rsi_hw *hw);
> --
>

Hi Hillf,

Hillf Danton <hdanton@sina.com> wrote:
>
> On Thu, 23 Apr 2026 02:38:46 +0900 Jeongjun Park wrote:
> > RSI driver use both self-exit(kthread_complete_and_exit) and external-stop
> > (kthread_stop) when killing a kthread. Generally, kthread_stop() is called
> > first, and in this case, no particular issues occur.
> >
> > However, in rare instances where kthread_complete_and_exit() is called
> > first and then kthread_stop() is called, a UAF occurs because the kthread
> > object, which has already exited and been freed, is accessed again.
> >
> Alternatively the race could be described with the regular diagram to better
> understand the uaf.
>
>         rsi_kill_thread()       rsi_tx_scheduler_thread()
>         ---                     ---
>         atomic_inc(&handle->thread_done); // set the done flag
>         rsi_set_event(&handle->event);
>
>                                 do {
>                                         something;
>                                 } while (atomic_read(&common->tx_thread.thread_done) == 0);
>                                 // exit after done
>                                 kthread_complete_and_exit(&common->tx_thread.completion, 0);
>
>         kthread_stop(handle->task); // uaf
>

I did not include the race scenario diagram separately to keep the
description brief. Apart from that, Hillf's diagram itself is accurate.

Regards,
Jeongjun Park