Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-50740

wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that usb_get_urb() is called but usb_free_urb() (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or urb->ep fields have not been initialized and usb_kill_urb() returns immediately. The patch removes trying to kill urbs located in hif_dev->tx.tx_buf because hif_dev->tx.tx_buf is not supposed to contain urbs which are in pending state (the pending urbs are stored in hif_dev->tx.tx_pending). The tx.tx_lock is acquired so there should not be any changes in the list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 6f0706ef39fecc6bf56d67728fe0c94e26b43e9d to < 134ae5eba41294eff76e4be20d6001b8f0192207affected
  • 795d57a558d106b8a5bc2bd7aeaf707d9a099244 to < 472312fef2b9eccaa03bd59e0ab2527da945e736affected
  • df4318440c1568b7dedc5f7d4e617d0e297a1313 to < eddbb8f7620f9f8008b090a6e10c460074ca575aaffected
  • a9990ed2d7ca9339d37c7f67d6f5cb298c3f1b34 to < 9850791d389b342ae6e573fe8198db0b4d338352affected
  • 03fb92a432ea5abe5909bca1455b7e44a9380480 to < c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884daffected
  • 03fb92a432ea5abe5909bca1455b7e44a9380480 to < d856f7574bcc1d81de565a857caf32f122cd7ce0affected
  • 03fb92a432ea5abe5909bca1455b7e44a9380480 to < c05189a429fdb371dd455c3c466d67ac2ebff152affected
  • 03fb92a432ea5abe5909bca1455b7e44a9380480 to < 08aa0537ec8cf29ceccae98acc1a534fc12598c1affected
  • 03fb92a432ea5abe5909bca1455b7e44a9380480 to < c2a94de38c74e86f49124ac14f093d6a5c377a90affected
  • b92e116ae36f498858dbb18e29a066c3f5348965affected
  • 7f5972267295fe49f8da8eb42bc2eb3d140860c0affected
  • 2d72d5ce63c92f56b9f978e8befb5838144176b9affected
  • 4.9.241 to < 4.9.337affected
  • 4.14.203 to < 4.14.303affected
  • 4.19.154 to < 4.19.270affected
  • 5.4.73 to < 5.4.229affected
  • 4.4.241 to < 4.5affected
  • 5.8.17 to < 5.9affected
  • 5.9.2 to < 5.10affected

Linux Linux

Default version status: affected

  • 5.10affected
  • 0 to < 5.10unaffected
  • 4.9.337 to ≤ 4.9.*unaffected
  • 4.14.303 to ≤ 4.14.*unaffected
  • 4.19.270 to ≤ 4.19.*unaffected
  • 5.4.229 to ≤ 5.4.*unaffected
  • 5.10.163 to ≤ 5.10.*unaffected
  • 5.15.86 to ≤ 5.15.*unaffected
  • 6.0.16 to ≤ 6.0.*unaffected
  • 6.1.2 to ≤ 6.1.*unaffected
  • 6.2 to ≤ *unaffected

References