CVE-2024-50236

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath10k: Fix memory leak in management tx<br /> <br /> In the current logic, memory is allocated for storing the MSDU context<br /> during management packet TX but this memory is not being freed during<br /> management TX completion. Similar leaks are seen in the management TX<br /> cleanup logic.<br /> <br /> Kmemleak reports this problem as below,<br /> <br /> unreferenced object 0xffffff80b64ed250 (size 16):<br /> comm "kworker/u16:7", pid 148, jiffies 4294687130 (age 714.199s)<br /> hex dump (first 16 bytes):<br /> 00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00 .+.......t......<br /> backtrace:<br /> [] __kmem_cache_alloc_node+0x1e4/0x2d8<br /> [] kmalloc_trace+0x48/0x110<br /> [] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core]<br /> [] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core]<br /> [] process_scheduled_works+0x1ac/0x400<br /> [] worker_thread+0x208/0x328<br /> [] kthread+0x100/0x1c0<br /> [] ret_from_fork+0x10/0x20<br /> <br /> Free the memory during completion and cleanup to fix the leak.<br /> <br /> Protect the mgmt_pending_tx idr_remove() operation in<br /> ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar-&gt;data_lock similar to<br /> other instances.<br /> <br /> Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1