CVE-2024-26605: PCI/ASPM: Fix deadlock when enabling ASPM
In the Linux kernel, the following vulnerability has been resolved:
PCI/ASPM: Fix deadlock when enabling ASPM
A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of Qualcomm PCIe controllers as reported by lockdep:
============================================ WARNING: possible recursive locking detected 6.7.0 #40 Not tainted -------------------------------------------- kworker/u16:5/90 is trying to acquire lock: ffffacfa78ced000 (pcibussem){++++}-{3:3}, at: pcieaspmpmstatechange+0x58/0xdc
but task is already holding lock: ffffacfa78ced000 (pcibussem){++++}-{3:3}, at: pciwalkbus+0x34/0xbc
other info that might help us debug this: Possible unsafe locking scenario:
CPU0 ---- lock(pcibussem); lock(pcibussem);
DEADLOCK
Call trace: printdeadlockbug+0x25c/0x348 lockacquire+0x10a4/0x2064 lockacquire+0x1e8/0x318 downread+0x60/0x184 pcieaspmpmstatechange+0x58/0xdc pcisetfullpowerstate+0xa8/0x114 pcisetpowerstate+0xc4/0x120 qcompcieenableaspm+0x1c/0x3c [pcieqcom] pciwalkbus+0x64/0xbc qcompciehostpostinit270+0x28/0x34 [pcieqcom]
The deadlock can easily be reproduced on machines like the Lenovo ThinkPad X13s by adding a delay to increase the race window during asynchronous probe where another thread can take a write lock.
Add a new pcisetpowerstatelocked() and associated helper functions that can be called with the PCI bus semaphore held to avoid taking the read lock twice.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
PCI/ASPM: Fix deadlock when enabling ASPM
The Linux kernel CVE team has assigned CVE-2024-26605 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024022419-CVE-2024-26605-7b06@gregkh/T/#u
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2001.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.90-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.7.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26605?
CVE-2024-26605 is considered a significant issue due to the potential deadlock it introduces when enabling ASPM.
How do I fix CVE-2024-26605?
To fix CVE-2024-26605, update your Linux kernel to version 6.8 or later.
Which versions of the Linux kernel are affected by CVE-2024-26605?
Versions of the Linux kernel between 6.7.0 and 6.7.5 are affected by CVE-2024-26605.
What components are impacted by CVE-2024-26605?
CVE-2024-26605 impacts the PCI/ASPM capability in the Linux kernel, specifically related to Qualcomm PCIe controllers.
Is there a patch available for CVE-2024-26605?
Yes, a patch is available in Linux kernel version 6.8 and it is recommended to upgrade to this version to resolve the issue.