staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Syzbot reported use-after-free in rtl8712_dl_fw(). The problem was in
race condition between r871xu_dev_remove() ->ndo_open() callback.
It's easy to see from crash log, that driver accesses released firmware
in ->ndo_open() callback. It may happen, since driver was releasing
firmware _before_ unregistering netdev. Fix it by moving
unregister_netdev() before cleaning up resources.
Call Trace:
...
rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline]
rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170
rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]
rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394
netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380
__dev_open+0x2bc/0x4d0 net/core/dev.c:1484
Freed by task 1306:
...
release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053
r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599
usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458
Analysis and contextual insights are available on OpenCVE Cloud.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 24 Sep 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.3:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.3:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.3:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.3:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.3:rc7:*:*:*:*:*:* |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Mon, 04 Nov 2024 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-11T13:55:28.973Z
Reserved: 2024-05-22T06:20:56.200Z
Link: CVE-2021-47479
Updated: 2024-08-04T05:39:59.455Z
Status : Analyzed
Published: 2024-05-22T09:15:09.817
Modified: 2025-09-24T19:04:38.687
Link: CVE-2021-47479
OpenCVE Enrichment
Updated: 2025-07-13T11:22:01Z