CVE-2022-49876

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mac80211: fix general-protection-fault in ieee80211_subif_start_xmit()<br /> <br /> When device is running and the interface status is changed, the gpf issue<br /> is triggered. The problem triggering process is as follows:<br /> Thread A: Thread B<br /> ieee80211_runtime_change_iftype() process_one_work()<br /> ... ...<br /> ieee80211_do_stop() ...<br /> ... ...<br /> sdata-&gt;bss = NULL ...<br /> ... ieee80211_subif_start_xmit()<br /> ieee80211_multicast_to_unicast<br /> //!sdata-&gt;bss-&gt;multicast_to_unicast<br /> cause gpf issue<br /> <br /> When the interface status is changed, the sending queue continues to send<br /> packets. After the bss is set to NULL, the bss is accessed. As a result,<br /> this causes a general-protection-fault issue.<br /> <br /> The following is the stack information:<br /> general protection fault, probably for non-canonical address<br /> 0xdffffc000000002f: 0000 [#1] PREEMPT SMP KASAN<br /> KASAN: null-ptr-deref in range [0x0000000000000178-0x000000000000017f]<br /> Workqueue: mld mld_ifc_work<br /> RIP: 0010:ieee80211_subif_start_xmit+0x25b/0x1310<br /> Call Trace:<br /> <br /> dev_hard_start_xmit+0x1be/0x990<br /> __dev_queue_xmit+0x2c9a/0x3b60<br /> ip6_finish_output2+0xf92/0x1520<br /> ip6_finish_output+0x6af/0x11e0<br /> ip6_output+0x1ed/0x540<br /> mld_sendpack+0xa09/0xe70<br /> mld_ifc_work+0x71c/0xdb0<br /> process_one_work+0x9bf/0x1710<br /> worker_thread+0x665/0x1080<br /> kthread+0x2e4/0x3a0<br /> ret_from_fork+0x1f/0x30<br />