In the Linux kernel, the following vulnerability has been resolved:
drivers: staging: rtl8723bs: Fix locking in rtwjointimeouthandler()
Commit 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in rtwjoinbsseventprehandle()") besides fixing the deadlock also modified _rtwjointimeouthandler() to use spin[un]lockirq() instead of spin[un]lockbh().
rtwjointimeouthandler() calls rtwdojoin() which takes pmlmepriv->scannedqueue.lock using spin[un]lockbh(). This spinunlockbh() call re-enables softirqs which triggers an oops in kernel/softirq.c: _localbhenableip() when it calls lockdepassertirqsenabled():
[ 244.506087] WARNING: CPU: 2 PID: 0 at kernel/softirq.c:376 localbhenableip+0xa6/0x100 ... [ 244.509022] Call Trace: [ 244.509048] <IRQ> [ 244.509100] _rtwjointimeouthandler+0x134/0x170 [r8723bs] [ 244.509468] ? _pfxrtwjointimeouthandler+0x10/0x10 [r8723bs] [ 244.509772] ? pfxrtwjointimeouthandler+0x10/0x10 [r8723bs] [ 244.510076] calltimerfn+0x95/0x2a0 [ 244.510200] _run_timers.part.0+0x1da/0x2d0
This oops is causd by the switch to spin[un]lockirq() which disables the IRQs for the entire duration of rtwjointimeouthandler().
Disabling the IRQs is not necessary since all code taking this lock runs from either user contexts or from softirqs, switch back to spin[un]lockbh() to fix this.
{ "vanir_signatures": [ { "id": "CVE-2023-53281-14a581a3", "signature_type": "Line", "target": { "file": "drivers/staging/rtl8723bs/core/rtw_mlme.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "298929837195916933207503088724361025540", "312065576873700504395463966290577753128", "167628917990184838510107899939863903736", "155121292157681657240515943769179474437", "121822544456948541826321226679452670037", "307510047082577985199399718480656821637", "237059799609937350792026695970699527795", "257079347889868997824159116428832560067" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ab1bace1dd3875371b481ef4301c4671bddea22" }, { "id": "CVE-2023-53281-2bce7800", "signature_type": "Line", "target": { "file": "drivers/staging/rtl8723bs/core/rtw_mlme.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "298929837195916933207503088724361025540", "312065576873700504395463966290577753128", "167628917990184838510107899939863903736", "155121292157681657240515943769179474437", "121822544456948541826321226679452670037", "307510047082577985199399718480656821637", "237059799609937350792026695970699527795", "257079347889868997824159116428832560067" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@215792eda008f6a1e7ed9d77fa20d582d22bb114" }, { "id": "CVE-2023-53281-6bfb628a", "signature_type": "Line", "target": { "file": "drivers/staging/rtl8723bs/core/rtw_mlme.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "298929837195916933207503088724361025540", "312065576873700504395463966290577753128", "167628917990184838510107899939863903736", "155121292157681657240515943769179474437", "121822544456948541826321226679452670037", "307510047082577985199399718480656821637", "237059799609937350792026695970699527795", "257079347889868997824159116428832560067" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a50e44a66d268ee5db3d177f1fdc1503dbce6e7" }, { "id": "CVE-2023-53281-c809f848", "signature_type": "Line", "target": { "file": "drivers/staging/rtl8723bs/core/rtw_mlme.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "298929837195916933207503088724361025540", "312065576873700504395463966290577753128", "167628917990184838510107899939863903736", "155121292157681657240515943769179474437", "121822544456948541826321226679452670037", "307510047082577985199399718480656821637", "237059799609937350792026695970699527795", "257079347889868997824159116428832560067" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@209850f17717a3b5cc558578bef5631ac7045539" }, { "id": "CVE-2023-53281-e1dbd8e5", "signature_type": "Line", "target": { "file": "drivers/staging/rtl8723bs/core/rtw_mlme.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "298929837195916933207503088724361025540", "312065576873700504395463966290577753128", "167628917990184838510107899939863903736", "155121292157681657240515943769179474437", "121822544456948541826321226679452670037", "307510047082577985199399718480656821637", "237059799609937350792026695970699527795", "257079347889868997824159116428832560067" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc327e87c6d9bfd9ee08e76396b3c0ba848ec554" } ] }