linux-cve-announce - CVE-2022-50361: wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091715-CVE-2022-50361-60ad@gregkh>
Date: Wed, 17 Sep 2025 16:56:20 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50361: wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()

Fault injection test reports this issue:

kernel BUG at net/core/dev.c:10731!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
Call Trace:
  <TASK>
  wilc_netdev_ifc_init+0x19f/0x220 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5]
  wilc_cfg80211_init+0x30c/0x380 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5]
  wilc_bus_probe+0xad/0x2b0 [wilc1000_spi 1520a7539b6589cc6cde2ae826a523a33f8bacff]
  spi_probe+0xe4/0x140
  really_probe+0x17e/0x3f0
  __driver_probe_device+0xe3/0x170
  driver_probe_device+0x49/0x120

The root case here is alloc_ordered_workqueue() fails, but
cfg80211_unregister_netdevice() or unregister_netdev() not be called in
error handling path. To fix add unregister_netdev goto lable to add the
unregister operation in error handling path.

The Linux kernel CVE team has assigned CVE-2022-50361 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit 09ed8bfc5215ad5aac91c50008277b5586b9ef24 and fixed in 6.1.16 with commit a1bdecedc7ad0512365267cd1a26bfc2ae455c59
	Issue introduced in 5.17 with commit 09ed8bfc5215ad5aac91c50008277b5586b9ef24 and fixed in 6.2.3 with commit 6da6ce086221803ed6c3b1db11096cecd3e58ec8
	Issue introduced in 5.17 with commit 09ed8bfc5215ad5aac91c50008277b5586b9ef24 and fixed in 6.3 with commit 2b88974ecb358990e1c33fabcd0b9e142bab7f21

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50361
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/microchip/wilc1000/netdev.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a1bdecedc7ad0512365267cd1a26bfc2ae455c59
	https://git.kernel.org/stable/c/6da6ce086221803ed6c3b1db11096cecd3e58ec8
	https://git.kernel.org/stable/c/2b88974ecb358990e1c33fabcd0b9e142bab7f21