In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb<\/p>\n
mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and a USB
\nheader onto every skb and assumes the headroom for them is already
\nthere. That holds for locally generated traffic, where mac80211
\nreserves hw->extra_tx_headroom, but forwarded frames are sent through
\nieee80211_8023_xmit(), which does not reserve it. Bridge a wired
\ninterface to an mt7925u AP and the first forwarded frame that arrives
\nshort panics the kernel:<\/p>\n
skbuff: skb_under_panic: len:415 put:4 tail:0x19b end:0x640 dev:wlan1
\n kernel BUG at net\/core\/skbuff.c:212!
\n Call trace:
\n skb_panic+0x58\/0x60 (P)
\n skb_push+0x58\/0x60
\n mt7925_usb_sdio_tx_prepare_skb+0xf8\/0x1b8 [mt7925_common]
\n mt76u_tx_queue_skb+0xa0\/0x1f8 [mt76_usb]
\n __mt76_tx_queue_skb+0x54\/0xe8 [mt76]
\n mt76_txq_schedule.part.0+0x204\/0x478 [mt76]
\n mt76_txq_schedule_all+0x50\/0x80 [mt76]
\n mt792x_tx_worker+0x68\/0x100 [mt792x_lib]
\n __mt76_worker_fn+0x84\/0x150 [mt76]<\/p>\n
Whether a given setup hits it depends on how much headroom the ingress
\nnetdev leaves in its rx skbs. Reproduced on a Raspberry Pi 5 bridging
\nonboard ethernet to a Netgear A9000; originally reported on an MT7986
\nrouter running OpenWrt. Nick Morrow’s testing on a Pi 4 (bcmgenet),
\nwhich leaves more headroom, helped narrow the trigger to the ingress
\npath.<\/p>\n
The same bug was fixed on mt7921 by commit 98c4d0abf5c4 (“mt76:
\nmt7921: don’t assume adequate headroom for SDIO headers”), but mt7925
\nwas copied from mt7921 without the fix. Add the same guard here.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb<\/p>\n
mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and a US<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17329","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}