In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath12k: fix inconsistent arvif state in vdev_create error paths<\/p>\n
ath12k_mac_vdev_create() has three error path issues that leave arvif
\nin an inconsistent state:<\/p>\n
1. When ath12k_wmi_vdev_create() fails, the function returns directly
\n without clearing arvif->ar, which was already set before the WMI
\n call. Subsequent code checking arvif->ar to determine vdev readiness
\n will see a non-NULL value despite no vdev existing in firmware.<\/p>\n
2. When ath12k_wmi_send_peer_delete_cmd() fails in err_peer_del, the
\n code jumped to err: skipping the DP peer cleanup and vdev rollback,
\n leaving num_created_vdevs, vdev maps and arvif list membership live.<\/p>\n
3. When ath12k_wait_for_peer_delete_done() fails, the code jumped to
\n err_vdev_del: skipping the DP peer cleanup.<\/p>\n
Fix by changing the ath12k_wmi_vdev_create() failure to goto err instead
\nof returning directly, routing both err_peer_del failure paths through
\nerr_dp_peer_del: for proper DP peer and vdev rollback, and consolidating
\nthe arvif state cleanup at err:.<\/p>\n
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath12k: fix inconsistent arvif state in vdev_create error paths<\/p>\n
ath12k_mac_vdev_create() has three error path issues that le<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8600","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8600"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}