CVE-2022-49200

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt

Fix the following kernel oops in btmtksdio_interrrupt

[ 14.339134] btmtksdio_interrupt+0x28/0x54

[ 14.339139] process_sdio_pending_irqs+0x68/0x1a0

[ 14.339144] sdio_irq_work+0x40/0x70

[ 14.339154] process_one_work+0x184/0x39c

[ 14.339160] worker_thread+0x228/0x3e8

[ 14.339168] kthread+0x148/0x3ac

[ 14.339176] ret_from_fork+0x10/0x30

That happened because hdev->power_on is already called before

sdio_set_drvdata which btmtksdio_interrupt handler relies on is not

properly set up.

The details are shown as the below: hci_register_dev would run

queue_work(hdev->req_workqueue, &hdev->power_on) as WQ_HIGHPRI

workqueue_struct to complete the power-on sequeunce and thus hci_power_on

may run before sdio_set_drvdata is done in btmtksdio_probe.

The hci_dev_do_open in hci_power_on would initialize the device and enable

the interrupt and thus it i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References