CVE-2022-49303

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drivers: staging: rtl8192eu: Fix deadlock in rtw_joinbss_event_prehandle

There is a deadlock in rtw_joinbss_event_prehandle(), which is shown below:

(Thread 1) | (Thread 2)

| _set_timer()

rtw_joinbss_event_prehandle()| mod_timer()

spin_lock_bh() //(1) | (wait a time)

... | rtw_join_timeout_handler()

| _rtw_join_timeout_handler()

del_timer_sync() | spin_lock_bh() //(2)

(wait timer to stop) | ...

We hold pmlmepriv->lock in position (1) of thread 1 and

use del_timer_sync() to wait timer to stop, but timer handler

also need pmlmepriv->lock in position (2) of thread 2.

As a result, rtw_joinbss_event_prehandle() will block forever.

This patch extracts del_timer_sync() from the protection of

spin_lock_bh(), which could let timer handler to obtain

the needed lock. What`s more, we cha

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References