摘要:

In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.

安全等级: Low

公告ID: KylinSec-SA-2024-3915

发布日期: 2024年10月12日

关联CVE: CVE-2024-46760