Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < cce3c0e21cdd15bcba5c35d3af1700186de8f187affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 1a08a37ac03d07a1608a1592791041cac979fbc3affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 54f8ef1a970a8376e5846ed90854decf7c00555daffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 114e05344763a102a8844efd96ec06ba99293ccdaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 6394bade9daab8e318c165fe43bba012bf13cd8eaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 6053e47bbf212b93c051beb4261d7d5a409d0ce3affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9d72df7f5eac946f853bf49c428c4e87a17d91daaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 958baf5eaee394e5fd976979b0791a875f14a179affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.4.301 to ≤ 5.4.*unaffected5.10.246 to ≤ 5.10.*unaffected5.15.195 to ≤ 5.15.*unaffected6.1.156 to ≤ 6.1.*unaffected6.6.112 to ≤ 6.6.*unaffected6.12.53 to ≤ 6.12.*unaffected6.17.3 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/cce3c0e21cdd15bcba5c35d3af1700186de8f187 ↗
- https://git.kernel.org/stable/c/1a08a37ac03d07a1608a1592791041cac979fbc3 ↗
- https://git.kernel.org/stable/c/54f8ef1a970a8376e5846ed90854decf7c00555d ↗
- https://git.kernel.org/stable/c/114e05344763a102a8844efd96ec06ba99293ccd ↗
- https://git.kernel.org/stable/c/6394bade9daab8e318c165fe43bba012bf13cd8e ↗
- https://git.kernel.org/stable/c/6053e47bbf212b93c051beb4261d7d5a409d0ce3 ↗
- https://git.kernel.org/stable/c/9d72df7f5eac946f853bf49c428c4e87a17d91da ↗
- https://git.kernel.org/stable/c/958baf5eaee394e5fd976979b0791a875f14a179 ↗