CVE-2022-49519

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ath10k: skip ath10k_halt during suspend for driver state RESTARTING

Double free crash is observed when FW recovery(caused by wmi

timeout/crash) is followed by immediate suspend event. The FW recovery

is triggered by ath10k_core_restart() which calls driver clean up via

ath10k_halt(). When the suspend event occurs between the FW recovery,

the restart worker thread is put into frozen state until suspend completes.

The suspend event triggers ath10k_stop() which again triggers ath10k_halt()

The double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be

called twice(Note: ath10k_htt_rx_alloc was not called by restart worker

thread because of its frozen state), causing the crash.

To fix this, during the suspend flow, skip call to ath10k_halt() in

ath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING.

Also, for driver state ATH10K_STATE_RESTARTING, call

ath10k_wait_for_suspend() in ath10k_stop().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References