In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: airoha: npu: cancel wdt_work after releasing the WDT IRQ<\/p>\n
airoha_npu_remove() calls cancel_work_sync() on each core’s wdt_work,
\nbut the watchdog IRQ that queues it is requested with devm_request_irq()
\nand is freed only after .remove() returns. airoha_npu_wdt_handler() can
\ntherefore schedule_work() again once the cancel has returned. struct
\nairoha_npu, which contains the work, is devm_kzalloc()’d and is freed in
\nthat same unwind, so the late work dereferences freed memory.<\/p>\n
Register the work with devm_work_autocancel() before devm_request_irq()
\nand drop .remove(). Devres runs in reverse order, so the IRQ is freed
\nbefore cancel_work_sync(), including when probe fails. A cancel left in
\n.remove() cannot get that order. Initializing the work first also stops
\na pending watchdog interrupt from queuing an uninitialized work item.
\nProbe currently calls INIT_WORK() only after devm_request_irq().<\/p>\n
This issue was identified during our ongoing static-analysis research
\nwhile reviewing kernel code.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: airoha: npu: cancel wdt_work after releasing the WDT IRQ<\/p>\n
airoha_npu_remove() calls cancel_work_sync() on each core’s wdt_work<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40968","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}