CVE-2024-42274: Revert "ALSA: firewire-lib: operate for period elapse event in process context"
In the Linux kernel, the following vulnerability has been resolved:
Revert "ALSA: firewire-lib: operate for period elapse event in process context"
Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") removed the process context workqueue from amdtpdomainstreampcmpointer() and updatepcmpointers() to remove its overhead.
With RME Fireface 800, this lead to a regression since Kernels 5.14.0, causing an AB/BA deadlock competition for the substream lock with eventual system freeze under ALSA operation:
thread 0: (lock A) acquire substream lock by sndpcmstreamlockirq() in sndpcmstatus64() (lock B) wait for tasklet to finish by calling taskletunlockspinwait() in taskletdisableinatomic() in ohciflushisocompletions() of ohci.c
thread 1: (lock B) enter tasklet (lock A) attempt to acquire substream lock, waiting for it to be released: sndpcmstreamlockirqsave() in sndpcmperiodelapsed() in updatepcmpointers() in processctxpayloads() in processrxpackets() of amdtp-stream.c
? taskletunlockspinwait </NMI> <TASK> ohciflushisocompletions firewireohci amdtpdomainstreampcmpointer sndfirewirelib sndpcmupdatehwptr0 sndpcm sndpcmstatus64 sndpcm
? nativequeuedspinlockslowpath </NMI> <IRQ> rawspinlockirqsave sndpcmperiodelapsed sndpcm processrxpackets sndfirewirelib irqtargetcallback sndfirewirelib handleitpacket firewireohci contexttasklet firewireohci
Restore the process context work queue to prevent deadlock AB/BA deadlock competition for ALSA substream lock of sndpcmstreamlockirq() in sndpcmstatus64() and sndpcmstreamlockirqsave() in sndpcmperiodelapsed().
revert commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context")
Replace inline description to prevent future deadlock.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42274?
CVE-2024-42274 has a severity rating that is determined by its impact on the system; specific details can be found in the vulnerability report.
How do I fix CVE-2024-42274?
To fix CVE-2024-42274, update your Linux kernel to one of the remedial versions specified in the vulnerability report.
What systems are affected by CVE-2024-42274?
CVE-2024-42274 affects specific versions of the Linux kernel, particularly those listed in the affected software section.
Is CVE-2024-42274 a remote vulnerability?
CVE-2024-42274's details regarding remote exploitation capabilities are outlined in its technical description.
What should I do if my system is running an affected version of CVE-2024-42274?
If your system is running an affected version, immediately apply the recommended updates to mitigate any potential risk.