| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-41036: net: ks8851: Fix deadlock with the SPI chip variant |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: ks8851: Fix deadlock with the SPI chip variant |
| |
| When SMP is enabled and spinlocks are actually functional then there is |
| a deadlock with the 'statelock' spinlock between ks8851_start_xmit_spi |
| and ks8851_irq: |
| |
| watchdog: BUG: soft lockup - CPU#0 stuck for 27s! |
| call trace: |
| queued_spin_lock_slowpath+0x100/0x284 |
| do_raw_spin_lock+0x34/0x44 |
| ks8851_start_xmit_spi+0x30/0xb8 |
| ks8851_start_xmit+0x14/0x20 |
| netdev_start_xmit+0x40/0x6c |
| dev_hard_start_xmit+0x6c/0xbc |
| sch_direct_xmit+0xa4/0x22c |
| __qdisc_run+0x138/0x3fc |
| qdisc_run+0x24/0x3c |
| net_tx_action+0xf8/0x130 |
| handle_softirqs+0x1ac/0x1f0 |
| __do_softirq+0x14/0x20 |
| ____do_softirq+0x10/0x1c |
| call_on_irq_stack+0x3c/0x58 |
| do_softirq_own_stack+0x1c/0x28 |
| __irq_exit_rcu+0x54/0x9c |
| irq_exit_rcu+0x10/0x1c |
| el1_interrupt+0x38/0x50 |
| el1h_64_irq_handler+0x18/0x24 |
| el1h_64_irq+0x64/0x68 |
| __netif_schedule+0x6c/0x80 |
| netif_tx_wake_queue+0x38/0x48 |
| ks8851_irq+0xb8/0x2c8 |
| irq_thread_fn+0x2c/0x74 |
| irq_thread+0x10c/0x1b0 |
| kthread+0xc8/0xd8 |
| ret_from_fork+0x10/0x20 |
| |
| This issue has not been identified earlier because tests were done on |
| a device with SMP disabled and so spinlocks were actually NOPs. |
| |
| Now use spin_(un)lock_bh for TX queue related locking to avoid execution |
| of softirq work synchronously that would lead to a deadlock. |
| |
| The Linux kernel CVE team has assigned CVE-2024-41036 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.1.70 with commit 1092525155eaad5c69ca9f3b6f3e7895a9424d66 and fixed in 6.1.100 with commit a0c69c492f4a8fad52f0a97565241c926160c9a4 |
| Issue introduced in 6.6.9 with commit 30302b41ffdcd194bef27fb3b1a9f2ca53dedb27 and fixed in 6.6.41 with commit 80ece00137300d74642f2038c8fe5440deaf9f05 |
| Issue introduced in 6.7 with commit 3dc5d44545453de1de9c53cc529cc960a85933da and fixed in 6.9.10 with commit 10fec0cd0e8f56ff06c46bb24254c7d8f8f2bbf0 |
| Issue introduced in 6.7 with commit 3dc5d44545453de1de9c53cc529cc960a85933da and fixed in 6.10 with commit 0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c |
| Issue introduced in 5.10.206 with commit 786788bb1396ed5ea27e39c4933f59f4e52004e4 |
| Issue introduced in 5.15.146 with commit 7c25c5d7274631b655f0f9098a16241fcd5db57b |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-41036 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/micrel/ks8851_common.c |
| drivers/net/ethernet/micrel/ks8851_spi.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/a0c69c492f4a8fad52f0a97565241c926160c9a4 |
| https://git.kernel.org/stable/c/80ece00137300d74642f2038c8fe5440deaf9f05 |
| https://git.kernel.org/stable/c/10fec0cd0e8f56ff06c46bb24254c7d8f8f2bbf0 |
| https://git.kernel.org/stable/c/0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c |
