In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: brcmfmac: drain bus_reset work on device removal<\/p>\n
brcmf_fw_crashed() and the debugfs “reset” entry both schedule
\ndrvr->bus_reset, whose callback recovers drvr through container_of()
\nand dereferences it. The removal path frees drvr (brcmf_free ->
\nwiphy_free) without draining the work, so a bus_reset callback pending
\nor running during removal can outlive drvr.<\/p>\n
Cancellation cannot live in brcmf_detach() or brcmf_free(): the work
\ncallback reaches teardown through the bus .reset op (PCIe
\nbrcmf_pcie_reset -> brcmf_detach; SDIO brcmf_sdio_bus_reset ->
\nbrcmf_sdiod_remove -> brcmf_free), so cancelling there would wait for
\nthe running work and deadlock.<\/p>\n
Add a per-bus mutex (bus_reset_lock) and route all arming through
\nbrcmf_bus_schedule_reset(), which under the lock skips when the bus is
\nmarked removing. Each bus remove entry calls
\nbrcmf_bus_cancel_reset_work(), which under the same lock sets removing
\nand cancels the work. Holding the mutex across cancel_work_sync() makes
\nthe set-removing + drain step atomic. Every producer reaches the arming
\npath from process context — the PCIe firmware-halt notification runs in
\nthe threaded IRQ handler (brcmf_pcie_isr_thread) and the SDIO hostmail
\npath runs from the data workqueue — so the mutex is taken only in
\nsleepable contexts. Where applicable the remove entry first stops the
\nfirmware-crash producer: on PCIe mask the mailbox and synchronize_irq;
\non SDIO unregister the bus interrupt and cancel the data worker, which
\nalso reports firmware halts through brcmf_fw_crashed(). The mutex is
\ninitialized at bus allocation. The SDIO suspend power-off path frees
\ndrvr through the same brcmf_sdiod_remove() and takes the same lock;
\nresume re-allows the work only on a successful re-probe.<\/p>\n
Also guard brcmf_fw_crashed() against a NULL bus_if\/drvr: it can fire
\nbefore brcmf_attach() wires up drvr, and it dereferences drvr
\n(bphy_err\/brcmf_dev_coredump) before reaching the arming gate.<\/p>\n
The bus_reset work is shared across buses, so the drain is applied to
\nevery remove path: PCIe (the .reset op introduced by the Fixes commit),
\nSDIO (arms the same work through brcmf_fw_crashed()), and USB (via the
\ndebugfs “reset” entry). cancel_work_sync() drains a running or pending
\nbus_reset work item before removal frees drvr, and patch 1\/2 makes the
\nscratch-buffer release safe when reset teardown has already released
\nthose DMA buffers.<\/p>\n
This patch fixes the lifetime of the bus_reset work item itself. It does
\nnot attempt to address the separate, pre-existing lifetime of the
\nasynchronous firmware completion started by the PCIe reset path. That
\ncallback needs its own lifetime\/ownership protocol and is being tracked
\nseparately.<\/p>\n
This issue was found by an in-house static analysis tool.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: brcmfmac: drain bus_reset work on device removal<\/p>\n
brcmf_fw_crashed() and the debugfs “reset” entry both schedule
\ndrvr->bus_re<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4876","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}