| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-37794: wifi: mac80211: Purge vif txq in ieee80211_do_stop() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| wifi: mac80211: Purge vif txq in ieee80211_do_stop() |
| |
| After ieee80211_do_stop() SKB from vif's txq could still be processed. |
| Indeed another concurrent vif schedule_and_wake_txq call could cause |
| those packets to be dequeued (see ieee80211_handle_wake_tx_queue()) |
| without checking the sdata current state. |
| |
| Because vif.drv_priv is now cleared in this function, this could lead to |
| driver crash. |
| |
| For example in ath12k, ahvif is store in vif.drv_priv. Thus if |
| ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be |
| NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to |
| trigger the NULL deref below. |
| |
| Unable to handle kernel paging request at virtual address dfffffc000000001 |
| KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] |
| batman_adv: bat0: Interface deactivated: brbh1337 |
| Mem abort info: |
| ESR = 0x0000000096000004 |
| EC = 0x25: DABT (current EL), IL = 32 bits |
| SET = 0, FnV = 0 |
| EA = 0, S1PTW = 0 |
| FSC = 0x04: level 0 translation fault |
| Data abort info: |
| ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 |
| CM = 0, WnR = 0, TnD = 0, TagAccess = 0 |
| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 |
| [dfffffc000000001] address between user and kernel address ranges |
| Internal error: Oops: 0000000096000004 [#1] SMP |
| CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114 |
| Hardware name: HW (DT) |
| pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) |
| pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] |
| lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k] |
| sp : ffffffc086ace450 |
| x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4 |
| x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e |
| x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0 |
| x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958 |
| x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8 |
| x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03 |
| x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40 |
| x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0 |
| x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001 |
| x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008 |
| Call trace: |
| ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P) |
| ieee80211_handle_wake_tx_queue+0x16c/0x260 |
| ieee80211_queue_skb+0xeec/0x1d20 |
| ieee80211_tx+0x200/0x2c8 |
| ieee80211_xmit+0x22c/0x338 |
| __ieee80211_subif_start_xmit+0x7e8/0xc60 |
| ieee80211_subif_start_xmit+0xc4/0xee0 |
| __ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0 |
| ieee80211_subif_start_xmit_8023+0x124/0x488 |
| dev_hard_start_xmit+0x160/0x5a8 |
| __dev_queue_xmit+0x6f8/0x3120 |
| br_dev_queue_push_xmit+0x120/0x4a8 |
| __br_forward+0xe4/0x2b0 |
| deliver_clone+0x5c/0xd0 |
| br_flood+0x398/0x580 |
| br_dev_xmit+0x454/0x9f8 |
| dev_hard_start_xmit+0x160/0x5a8 |
| __dev_queue_xmit+0x6f8/0x3120 |
| ip6_finish_output2+0xc28/0x1b60 |
| __ip6_finish_output+0x38c/0x638 |
| ip6_output+0x1b4/0x338 |
| ip6_local_out+0x7c/0xa8 |
| ip6_send_skb+0x7c/0x1b0 |
| ip6_push_pending_frames+0x94/0xd0 |
| rawv6_sendmsg+0x1a98/0x2898 |
| inet_sendmsg+0x94/0xe0 |
| __sys_sendto+0x1e4/0x308 |
| __arm64_sys_sendto+0xc4/0x140 |
| do_el0_svc+0x110/0x280 |
| el0_svc+0x20/0x60 |
| el0t_64_sync_handler+0x104/0x138 |
| el0t_64_sync+0x154/0x158 |
| |
| To avoid that, empty vif's txq at ieee80211_do_stop() so no packet could |
| be dequeued after ieee80211_do_stop() (new packets cannot be queued |
| because SDATA_STATE_RUNNING is cleared at this point). |
| |
| The Linux kernel CVE team has assigned CVE-2025-37794 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.1 with commit ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 and fixed in 5.4.293 with commit 929ec2c9ad34248ef625e137b6118b6e965797d9 |
| Issue introduced in 4.1 with commit ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 and fixed in 5.10.237 with commit a932a5ce4eee0cbad20220f950fe7bd3534bcbc9 |
| Issue introduced in 4.1 with commit ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 and fixed in 5.15.181 with commit 305741e7e63234cbcf9b5c4e6aeca25ba0834be8 |
| Issue introduced in 4.1 with commit ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 and fixed in 6.1.135 with commit 5f6863dc407f25fcf23fc857f9ac51756a09ea2c |
| Issue introduced in 4.1 with commit ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 and fixed in 6.6.88 with commit c74b84544dee27298a71715b3ce2c40d372b5a23 |
| Issue introduced in 4.1 with commit ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 and fixed in 6.12.25 with commit a8df245b5b29f6de98d016dc18e2bb35ec70b0cb |
| Issue introduced in 4.1 with commit ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 and fixed in 6.14.4 with commit 8bc34db7f771a464ff8f686b6f8d4e04963fec27 |
| Issue introduced in 4.1 with commit ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 and fixed in 6.15 with commit 378677eb8f44621ecc9ce659f7af61e5baa94d81 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-37794 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/mac80211/iface.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/929ec2c9ad34248ef625e137b6118b6e965797d9 |
| https://git.kernel.org/stable/c/a932a5ce4eee0cbad20220f950fe7bd3534bcbc9 |
| https://git.kernel.org/stable/c/305741e7e63234cbcf9b5c4e6aeca25ba0834be8 |
| https://git.kernel.org/stable/c/5f6863dc407f25fcf23fc857f9ac51756a09ea2c |
| https://git.kernel.org/stable/c/c74b84544dee27298a71715b3ce2c40d372b5a23 |
| https://git.kernel.org/stable/c/a8df245b5b29f6de98d016dc18e2bb35ec70b0cb |
| https://git.kernel.org/stable/c/8bc34db7f771a464ff8f686b6f8d4e04963fec27 |
| https://git.kernel.org/stable/c/378677eb8f44621ecc9ce659f7af61e5baa94d81 |
