wifi: ath11k: fix warning when unbinding
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
exploitation probability
0.2%top 94% of all CVEs
observed exploitation
nono source reports it
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix warning when unbinding
If there is an error during some initialization related to firmware,
the buffers dp->tx_ring[i].tx_status are released.
However this is released again when the device is unbinded (ath11k_pci),
and we get:
WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90
Call Trace:
free_large_kmalloc
ath11k_dp_free
ath11k_core_deinit
ath11k_pci_remove
...
The issue is always reproducible from a VM because the MSI addressing
initialization is failing.
In order to fix the issue, just set the buffers to NULL after releasing in
order to avoid the double free.
Affected products
Linux · LinuxReferences
https://git.kernel.org/stable/c/051f954b94479d72222c9fbc82a3eef4777bca01https://git.kernel.org/stable/c/0a946abb82f29abe9a15173b707a449cb039b43ehttps://git.kernel.org/stable/c/0aa097a370277deab5337030b9e2d395742f469chttps://git.kernel.org/stable/c/318703b6f71d1a29ee0ac46c32a38f7734d4cfb2https://git.kernel.org/stable/c/40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0ahttps://git.kernel.org/stable/c/7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13https://git.kernel.org/stable/c/8b7a26b6681922a38cd5a7829ace61f8e54df9b7https://git.kernel.org/stable/c/e569a5cb401a267168621aa9a1e7f07fcc9612c3