CVE-2022-50187

In the Linux kernel, the following vulnerability has been resolved:

ath11k: fix netdev open race

Make sure to allocate resources needed before registering the device.

This specifically avoids having a racing open() trigger a BUGON() in modtimer() when ath11kmacopstart() is called before the monreap_timer as been set up.

I did not see this issue with next-20220310, but I hit it on every probe with next-20220511. Perhaps some timing changed in between.

Here's the backtrace:

[ 51.346947] kernel BUG at kernel/time/timer.c:990! [ 51.346958] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ... [ 51.578225] Call trace: [ 51.583293] __modtimer+0x298/0x390 [ 51.589518] modtimer+0x14/0x20 [ 51.595368] ath11k_macopstart+0x41c/0x4a0 [ath11k] [ 51.603165] drvstart+0x38/0x60 [mac80211] [ 51.610110] ieee80211doopen+0x29c/0x7d0 [mac80211] [ 51.617945] ieee80211open+0x60/0xb0 [mac80211] [ 51.625311] __dev_open+0x100/0x1c0 [ 51.631420] __devchangeflags+0x194/0x210 [ 51.638214] devchangeflags+0x24/0x70 [ 51.644646] do_setlink+0x228/0xdb0 [ 51.650723] __rtnlnewlink+0x460/0x830 [ 51.657162] rtnlnewlink+0x4c/0x80 [ 51.663229] rtnetlink_rcvmsg+0x124/0x390 [ 51.669917] netlinkrcvskb+0x58/0x130 [ 51.676314] rtnetlinkrcv+0x18/0x30 [ 51.682460] netlinkunicast+0x250/0x310 [ 51.688960] netlinksendmsg+0x19c/0x3e0 [ 51.695458] ____sys_sendmsg+0x220/0x290 [ 51.701938] ___sys_sendmsg+0x7c/0xc0 [ 51.708148] __sys_sendmsg+0x68/0xd0 [ 51.714254] _arm64syssendmsg+0x28/0x40 [ 51.720900] invokesyscall+0x48/0x120

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPLV1V2SILICONZLITE-3