CVE-2021-47349

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mwifiex: bring down link before deleting interface

We can deadlock when rmmod'ing the driver or going through firmware

reset, because the cfg80211_unregister_wdev() has to bring down the link

for us, ... which then grab the same wiphy lock.

nl80211_del_interface() already handles a very similar case, with a nice

description:

/*

* We hold RTNL, so this is safe, without RTNL opencount cannot

* reach 0, and thus the rdev cannot be deleted.

*

* We need to do it for the dev_close(), since that will call

* the netdev notifiers, and we need to acquire the mutex there

* but don't know if we get there from here or from some other

* place (e.g. "ip link set ... down").

*/

mutex_unlock(&rdev->wiphy.mtx);

...

Do similarly for mwifiex teardown, by ensuring we bring the link down

first.

Sample deadlock trace:

[ 247.103516] INFO: task rmmo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References