CVE-2024-41036: net: ks8851: Fix deadlock with the SPI chip variant
In the Linux kernel, the following vulnerability has been resolved:
net: ks8851: Fix deadlock with the SPI chip variant
When SMP is enabled and spinlocks are actually functional then there is a deadlock with the 'statelock' spinlock between ks8851startxmitspi and ks8851irq:
watchdog: BUG: soft lockup - CPU#0 stuck for 27s! call trace: queuedspinlockslowpath+0x100/0x284 dorawspinlock+0x34/0x44 ks8851startxmitspi+0x30/0xb8 ks8851startxmit+0x14/0x20 netdevstartxmit+0x40/0x6c devhardstartxmit+0x6c/0xbc schdirectxmit+0xa4/0x22c qdiscrun+0x138/0x3fc qdiscrun+0x24/0x3c nettxaction+0xf8/0x130 handlesoftirqs+0x1ac/0x1f0 dosoftirq+0x14/0x20 dosoftirq+0x10/0x1c callonirqstack+0x3c/0x58 dosoftirqownstack+0x1c/0x28 irqexitrcu+0x54/0x9c irqexitrcu+0x10/0x1c el1interrupt+0x38/0x50 el1h64irqhandler+0x18/0x24 el1h64irq+0x64/0x68 netifschedule+0x6c/0x80 netiftxwakequeue+0x38/0x48 ks8851irq+0xb8/0x2c8 irqthreadfn+0x2c/0x74 irqthread+0x10c/0x1b0 kthread+0xc8/0xd8 retfromfork+0x10/0x20
This issue has not been identified earlier because tests were done on a device with SMP disabled and so spinlocks were actually NOPs.
Now use spin(un)lockbh for TX queue related locking to avoid execution of softirq work synchronously that would lead to a deadlock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41036?
CVE-2024-41036 has a moderate severity rating due to its potential for deadlock in the kernel.
What systems are affected by CVE-2024-41036?
CVE-2024-41036 affects various versions of the Linux kernel, including versions ranging from 6.1.70 to 6.6.41 and any 6.10 release candidates.
How do I fix CVE-2024-41036?
To fix CVE-2024-41036, users should update to patched kernel versions such as 6.1.123-1 or 6.12.12-1.
What is the impact of not addressing CVE-2024-41036?
Failure to address CVE-2024-41036 may result in system instability or deadlocks during operation.
Is CVE-2024-41036 related to specific hardware?
Yes, CVE-2024-41036 specifically pertains to the ks8851 SPI chip variant in the Linux kernel.