CVE-2022-49132: ath11k: pci: fix crash on suspend if board file is not found
In the Linux kernel, the following vulnerability has been resolved:
ath11k: pci: fix crash on suspend if board file is not found
Mario reported that the kernel was crashing on suspend if ath11k was not able to find a board file:
[ 473.693286] PM: Suspending system (s2idle) [ 473.693291] printk: Suspending console(s) (use noconsolesuspend to debug) [ 474.407787] BUG: unable to handle page fault for address: 0000000000002070 [ 474.407791] #PF: supervisor read access in kernel mode [ 474.407794] #PF: errorcode(0x0000) - not-present page [ 474.407798] PGD 0 P4D 0 [ 474.407801] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 474.407805] CPU: 2 PID: 2350 Comm: kworker/u32:14 Tainted: G W 5.16.0 #248 [...] [ 474.407868] Call Trace: [ 474.407870] <TASK> [ 474.407874] ? rawspinlockirqsave+0x2a/0x60 [ 474.407882] ? locktimerbase+0x72/0xa0 [ 474.407889] ? rawspinunlockirqrestore+0x29/0x3d [ 474.407892] ? trytodeltimersync+0x54/0x80 [ 474.407896] ath11kdprxpktlogstop+0x49/0xc0 [ath11k] [ 474.407912] ath11kcoresuspend+0x34/0x130 [ath11k] [ 474.407923] ath11kpcipmsuspend+0x1b/0x50 [ath11kpci] [ 474.407928] pcipmsuspend+0x7e/0x170 [ 474.407935] ? pcipmfreeze+0xc0/0xc0 [ 474.407939] dpmruncallback+0x4e/0x150 [ 474.407947] devicesuspend+0x148/0x4c0 [ 474.407951] asyncsuspend+0x20/0x90 dmesg-efi-164255130401001: Oops#1 Part1 [ 474.407955] asyncrunentryfn+0x33/0x120 [ 474.407959] processonework+0x220/0x3f0 [ 474.407966] workerthread+0x4a/0x3d0 [ 474.407971] kthread+0x17a/0x1a0 [ 474.407975] ? processonework+0x3f0/0x3f0 [ 474.407979] ? setkthreadstruct+0x40/0x40 [ 474.407983] retfromfork+0x22/0x30 [ 474.407991] </TASK>
The issue here is that board file loading happens after ath11kpciprobe() succesfully returns (ath11k initialisation happends asynchronously) and the suspend handler is still enabled, of course failing as ath11k is not properly initialised. Fix this by checking ATH11KFLAGQMIFAIL during both suspend and resume.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPLV1V2SILICONZLITE-2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the ath11k driver, check ATH11K_FLAG_QMI_FAIL during both suspend and resume so the suspend handler does not proceed when ath11k could not initialize due to QMI failure / missing board file.
Linux kernel ath11k ATH11K_FLAG_QMI_FAIL check = check in both suspend and resume paths - Compensating control
Ensure board file loading is available/located so ath11k_pci_probe() can find the board file before suspend (the crash described occurs when the board file is not found, and ath11k initialization happens asynchronously after probe).
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49132?
CVE-2022-49132 is classified as a low severity vulnerability.
How do I fix CVE-2022-49132?
To fix CVE-2022-49132, update the Linux kernel to a version that addresses this vulnerability.
Which Linux kernel versions are affected by CVE-2022-49132?
CVE-2022-49132 affects Linux kernel versions between 5.6 and 5.15.34, as well as 5.16 to 5.16.20 and 5.17 to 5.17.3.
What causes the crash in CVE-2022-49132?
The crash occurs on suspend when the ath11k driver cannot find the required board file.
Who reported the CVE-2022-49132 vulnerability?
The vulnerability was reported by a user named Mario.