Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 to < f30e8af109818c9db08cbcc46eb9713fe4b530baaffected7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 to < aab7b39fcac5f6165f6434bcbb56bb7865d4ad2baffected7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 to < b83db8e756dec68a950ed2f056248b1704b3deaaaffected7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 to < 43d07103df670484cdd26f9588eabef80f69db89affected7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 to < c2ace6300600c634553657785dfe5ea0ed688ac2affected
Linux Linux
Default version status: affected
4.19affected0 to < 4.19unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.31 to ≤ 6.6.*unaffected6.8.10 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f30e8af109818c9db08cbcc46eb9713fe4b530ba ↗
- https://git.kernel.org/stable/c/aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b ↗
- https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa ↗
- https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89 ↗
- https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗