CVE-2022-50179

In the Linux kernel, the following vulnerability has been resolved:

ath9k: fix use-after-free in ath9khifusbrxcb

Syzbot reported use-after-free Read in ath9khifusbrxcb() [0]. The problem was in incorrect htchandle->drvpriv initialization.

Probable call trace which can trigger use-after-free:

ath9khtcprobedevice() /* htchandle->drvpriv = priv; */ ath9khtcwaitfortarget() <--- Failed ieee80211free_hw() <--- priv pointer is freed

<IRQ> ... ath9khifusbrxcb() ath9khifusbrxstream() RXSTATINC() <--- htchandle->drvpriv access

In order to not add fancy protection for drvpriv we can move htchandle->drvpriv initialization at the end of the ath9khtcprobedevice() and add helper macro to make all _STAT_ macros NULL safe, since syzbot has reported related NULL deref in that macros [1]