In the Linux kernel, the following vulnerability has been resolved:
ath11k: disable spectral scan during spectral deinit
When ath11k modules are removed using rmmod with spectral scan enabled, crash is observed. Different crash trace is observed for each crash.
Send spectral scan disable WMI command to firmware before cleaning the spectral dbring in the spectral_deinit API to avoid this crash.
call trace from one of the crash observed: [ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008 [ 1252.882722] pgd = 0f42e886 [ 1252.890955] [00000008] *pgd=00000000 [ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0 [ 1253.115261] Hardware name: Generic DT based system [ 1253.121149] PC is at ath11kspectralprocessdata+0x434/0x574 [ath11k] [ 1253.125940] LR is at 0x88e31017 [ 1253.132448] pc : [<7f9387b8>] lr : [<88e31017>] psr: a0000193 [ 1253.135488] sp : 80d01bc8 ip : 00000001 fp : 970e0000 [ 1253.141737] r10: 88e31000 r9 : 970ec000 r8 : 00000080 [ 1253.146946] r7 : 94734040 r6 : a0000113 r5 : 00000057 r4 : 00000000 [ 1253.152159] r3 : e18cb694 r2 : 00000217 r1 : 1df1f000 r0 : 00000001 [ 1253.158755] Flags: NzCv IRQs off FIQs on Mode SVC32 ISA ARM Segment user [ 1253.165266] Control: 10c0383d Table: 5e71006a DAC: 00000055 [ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141) [ 1253.458055] [<7f9387b8>] (ath11kspectralprocessdata [ath11k]) from [<7f917fdc>] (ath11kdbringbufferreleaseevent+0x214/0x2e4 [ath11k]) [ 1253.466139] [<7f917fdc>] (ath11kdbringbufferreleaseevent [ath11k]) from [<7f8ea3c4>] (ath11kwmitlvoprx+0x1840/0x29cc [ath11k]) [ 1253.478807] [<7f8ea3c4>] (ath11kwmitlvoprx [ath11k]) from [<7f8fe868>] (ath11khtcrxcompletionhandler+0x180/0x4e0 [ath11k]) [ 1253.490699] [<7f8fe868>] (ath11khtcrxcompletionhandler [ath11k]) from [<7f91308c>] (ath11kceperengineservice+0x2c4/0x3b4 [ath11k]) [ 1253.502386] [<7f91308c>] (ath11kceperengineservice [ath11k]) from [<7f9a4198>] (ath11kpcicetasklet+0x28/0x80 [ath11kpci]) [ 1253.514811] [<7f9a4198>] (ath11kpcicetasklet [ath11kpci]) from [<8032227c>] (taskletactioncommon.constprop.2+0x64/0xe8) [ 1253.526476] [<8032227c>] (taskletactioncommon.constprop.2) from [<803021e8>] (dosoftirq+0x130/0x2d0) [ 1253.537756] [<803021e8>] (dosoftirq) from [<80322610>] (irqexit+0xcc/0xe8) [ 1253.547304] [<80322610>] (irqexit) from [<8036a4a4>] (handledomainirq+0x60/0xb4) [ 1253.554428] [<8036a4a4>] (handledomainirq) from [<805eb348>] (gichandleirq+0x4c/0x90) [ 1253.562321] [<805eb348>] (gichandleirq) from [<80301a78>] (irqsvc+0x58/0x8c)
Tested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1
[
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-01c68420",
"digest": {
"function_hash": "252121216706867899005899467942810111951",
"length": 199.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60afa4f4e1350c876d8a061182a70c224de275dd",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_ring_free",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-0a51f53c",
"digest": {
"function_hash": "178294642022893721919455507940696731397",
"length": 2016.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@161c64de239c7018e0295e7e0520a19f00aa32dc",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_scan_config",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-133e147a",
"digest": {
"function_hash": "118163573569601613218684372766300369189",
"length": 393.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b9c54caef58d2b55074710952cda70540722c01",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_deinit",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-17588245",
"digest": {
"function_hash": "178294642022893721919455507940696731397",
"length": 2016.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b9c54caef58d2b55074710952cda70540722c01",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_scan_config",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-18848939",
"digest": {
"function_hash": "252121216706867899005899467942810111951",
"length": 199.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b9c54caef58d2b55074710952cda70540722c01",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_ring_free",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-269d4f04",
"digest": {
"function_hash": "118163573569601613218684372766300369189",
"length": 393.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f15e67af9bec5a69e815e0230a70cffddae371a",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_deinit",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-26f46fa1",
"digest": {
"function_hash": "178294642022893721919455507940696731397",
"length": 2016.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60afa4f4e1350c876d8a061182a70c224de275dd",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_scan_config",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-3f447ae7",
"digest": {
"function_hash": "178294642022893721919455507940696731397",
"length": 2016.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f15e67af9bec5a69e815e0230a70cffddae371a",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_scan_config",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-58bd290a",
"digest": {
"function_hash": "118163573569601613218684372766300369189",
"length": 393.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60afa4f4e1350c876d8a061182a70c224de275dd",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_deinit",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-5be370ed",
"digest": {
"line_hashes": [
"19594810589026031866033410749725161702",
"117278710312918269751705240116382439419",
"237576131351252144192684728798480229175",
"320828687355637391096892202569120715386",
"85305369471962389099291013562422205624",
"290278798885059586113567133288785789210",
"165450006450167687119346828663718110009",
"178260425607624420696330800555056109798",
"300947666856406691821851222456106761628",
"48109557089655323308917857465406881719",
"120426078769431417073306533198431203306",
"260694111163187866488795555267853446773",
"42338181728513943146899051940982969748",
"140069904894504445376150728098290684539",
"49272862501374165030143306320240788285",
"27350133397977045628612728024598008010",
"235486450649656838222827668014882434418",
"291034172177682229553061890139248544707",
"181756814192668623328941608778443869030"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f15e67af9bec5a69e815e0230a70cffddae371a",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-8478470c",
"digest": {
"function_hash": "252121216706867899005899467942810111951",
"length": 199.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@451b9076903a057b7b8d5b24dc84b3e436a1c743",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_ring_free",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-988888bf",
"digest": {
"line_hashes": [
"19594810589026031866033410749725161702",
"117278710312918269751705240116382439419",
"237576131351252144192684728798480229175",
"320828687355637391096892202569120715386",
"85305369471962389099291013562422205624",
"290278798885059586113567133288785789210",
"165450006450167687119346828663718110009",
"178260425607624420696330800555056109798",
"300947666856406691821851222456106761628",
"48109557089655323308917857465406881719",
"120426078769431417073306533198431203306",
"260694111163187866488795555267853446773",
"42338181728513943146899051940982969748",
"140069904894504445376150728098290684539",
"49272862501374165030143306320240788285",
"27350133397977045628612728024598008010",
"235486450649656838222827668014882434418",
"291034172177682229553061890139248544707",
"181756814192668623328941608778443869030"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@451b9076903a057b7b8d5b24dc84b3e436a1c743",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-9d091e55",
"digest": {
"function_hash": "118163573569601613218684372766300369189",
"length": 393.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@161c64de239c7018e0295e7e0520a19f00aa32dc",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_deinit",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-b86fc64b",
"digest": {
"line_hashes": [
"19594810589026031866033410749725161702",
"117278710312918269751705240116382439419",
"237576131351252144192684728798480229175",
"320828687355637391096892202569120715386",
"85305369471962389099291013562422205624",
"290278798885059586113567133288785789210",
"165450006450167687119346828663718110009",
"178260425607624420696330800555056109798",
"300947666856406691821851222456106761628",
"48109557089655323308917857465406881719",
"120426078769431417073306533198431203306",
"260694111163187866488795555267853446773",
"42338181728513943146899051940982969748",
"140069904894504445376150728098290684539",
"49272862501374165030143306320240788285",
"27350133397977045628612728024598008010",
"235486450649656838222827668014882434418",
"291034172177682229553061890139248544707",
"181756814192668623328941608778443869030"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b9c54caef58d2b55074710952cda70540722c01",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-c14af508",
"digest": {
"line_hashes": [
"19594810589026031866033410749725161702",
"117278710312918269751705240116382439419",
"237576131351252144192684728798480229175",
"320828687355637391096892202569120715386",
"85305369471962389099291013562422205624",
"290278798885059586113567133288785789210",
"165450006450167687119346828663718110009",
"178260425607624420696330800555056109798",
"300947666856406691821851222456106761628",
"48109557089655323308917857465406881719",
"120426078769431417073306533198431203306",
"260694111163187866488795555267853446773",
"42338181728513943146899051940982969748",
"140069904894504445376150728098290684539",
"49272862501374165030143306320240788285",
"27350133397977045628612728024598008010",
"235486450649656838222827668014882434418",
"291034172177682229553061890139248544707",
"181756814192668623328941608778443869030"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60afa4f4e1350c876d8a061182a70c224de275dd",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-e4fc6e3d",
"digest": {
"function_hash": "178294642022893721919455507940696731397",
"length": 2016.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@451b9076903a057b7b8d5b24dc84b3e436a1c743",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_scan_config",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-f74adaee",
"digest": {
"function_hash": "118163573569601613218684372766300369189",
"length": 393.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@451b9076903a057b7b8d5b24dc84b3e436a1c743",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_deinit",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-fc2a9ed7",
"digest": {
"function_hash": "252121216706867899005899467942810111951",
"length": 199.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@161c64de239c7018e0295e7e0520a19f00aa32dc",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_ring_free",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-fdbcac8d",
"digest": {
"function_hash": "252121216706867899005899467942810111951",
"length": 199.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f15e67af9bec5a69e815e0230a70cffddae371a",
"signature_type": "Function",
"target": {
"function": "ath11k_spectral_ring_free",
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49523-feac7969",
"digest": {
"line_hashes": [
"19594810589026031866033410749725161702",
"117278710312918269751705240116382439419",
"237576131351252144192684728798480229175",
"320828687355637391096892202569120715386",
"85305369471962389099291013562422205624",
"290278798885059586113567133288785789210",
"165450006450167687119346828663718110009",
"178260425607624420696330800555056109798",
"300947666856406691821851222456106761628",
"48109557089655323308917857465406881719",
"120426078769431417073306533198431203306",
"260694111163187866488795555267853446773",
"42338181728513943146899051940982969748",
"140069904894504445376150728098290684539",
"49272862501374165030143306320240788285",
"27350133397977045628612728024598008010",
"235486450649656838222827668014882434418",
"291034172177682229553061890139248544707",
"181756814192668623328941608778443869030"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@161c64de239c7018e0295e7e0520a19f00aa32dc",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath11k/spectral.c"
}
}
]