In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
Inthe Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In theLinux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx workafter everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine canstart getting USB replies beforertw_dev isfully setup.Thestacktrace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo whilewe do theasyncstuff rtw_usb_probe continues and callsrtw_register_hw,which does allkinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving thefirst usb_submit_urbafter everythingis set up.For me, this bug manifestedas:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'musing Larry's backport ofrtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.TheLinux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
Inthe Linuxkernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work aftereverything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can startgetting USB replies beforertw_dev is fullysetup.The stacktracelooks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we dothe asyncstuffrtw_usb_probe continues and callsrtw_register_hw, whichdoes all kindsof initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the firstusb_submit_urb aftereverythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm usingLarry's backport of rtw88driver with the NULLchecks in rtw_rx_fill_rx_status.The Linuxkernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it s possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I m using Larry s backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: usb: schedule rx work after everything is set upRight now it's possible to hit NULL pointer dereference inrtw_rx_fill_rx_status on hw object and/or its fields becauseinitialization routine can start getting USB replies beforertw_dev is fully setup.The stack trace looks like this:rtw_rx_fill_rx_statusrtw8821c_query_rx_descrtw_usb_rx_handler...queue_workrtw_usb_read_port_complete...usb_submit_urbrtw_usb_rx_resubmitrtw_usb_init_rxrtw_usb_probeSo while we do the async stuff rtw_usb_probe continues and callsrtw_register_hw, which does all kinds of initialization (e.g.via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.Fix this by moving the first usb_submit_urb after everythingis set up.For me, this bug manifested as:[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_statusbecause I'm using Larry's backport of rtw88 driver with the NULLchecks in rtw_rx_fill_rx_status.The Linux kernel CVE team has assigned CVE-2024-46760 to this issue.
