CVE-2024-47715: wifi: mt76: mt7915: fix oops on non-dbdc mt7986
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix oops on non-dbdc mt7986
mt7915bandconfig() sets bandidx = 1 on the main phy for mt7986 with MT7975ONEADIE or MT7976ONEADIE.
Commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status") introduced a dereference of the phys array indirectly indexed by bandidx via wcid->phyidx in mt76wcidcleanup(). This caused the following Oops on affected mt7986 devices:
Unable to handle kernel read from unreadable memory at virtual address 0000000000000024 Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005 CM = 0, WnR = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000 [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: ... mt7915e mt76connaclib mt76 mac80211 cfg80211 ... CPU: 2 PID: 1631 Comm: hostapd Not tainted 5.15.150 #0 Hardware name: ZyXEL EX5700 (Telenor) (DT) pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mt76wcidcleanup+0x84/0x22c [mt76] lr : mt76wcidcleanup+0x64/0x22c [mt76] sp : ffffffc00a803700 x29: ffffffc00a803700 x28: ffffff80008f7300 x27: ffffff80003f3c00 x26: ffffff80000a7880 x25: ffffffc008c26e00 x24: 0000000000000001 x23: ffffffc000a68114 x22: 0000000000000000 x21: ffffff8004172cc8 x20: ffffffc00a803748 x19: ffffff8004152020 x18: 0000000000000000 x17: 00000000000017c0 x16: ffffffc008ef5000 x15: 0000000000000be0 x14: ffffff8004172e28 x13: ffffff8004172e28 x12: 0000000000000000 x11: 0000000000000000 x10: ffffff8004172e30 x9 : ffffff8004172e28 x8 : 0000000000000000 x7 : ffffff8004156020 x6 : 0000000000000000 x5 : 0000000000000031 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : ffffff80008f7300 x0 : 0000000000000024 Call trace: mt76wcidcleanup+0x84/0x22c [mt76] mt76staremove+0x70/0xbc [mt76] mt76stastate+0x8c/0x1a4 [mt76] mt7915eepromgetpowerdelta+0x11e4/0x23a0 [mt7915e] drvstastate+0x144/0x274 [mac80211] stainfomovestate+0x1cc/0x2a4 [mac80211] stasetsinfo+0xaf8/0xc24 [mac80211] stainfodestroyaddrbss+0x4c/0x6c [mac80211]
ieee80211colorchangefinish+0x1c08/0x1e70 [mac80211] cfg80211checkstationchange+0x1360/0x4710 [cfg80211] genlfamilyrcvmsgdoit+0xb4/0x110 genlrcvmsg+0xd0/0x1bc netlinkrcvskb+0x58/0x120 genlrcv+0x34/0x50 netlinkunicast+0x1f0/0x2ec netlinksendmsg+0x198/0x3d0 syssendmsg+0x1b0/0x210 syssendmsg+0x80/0xf0 syssendmsg+0x44/0xa0 arm64syssendmsg+0x20/0x30 invokesyscall.constprop.0+0x4c/0xe0 doel0svc+0x40/0xd0 el0svc+0x14/0x4c el0t64synchandler+0x100/0x110 el0t64sync+0x15c/0x160 Code: d2800002 910092c0 52800023 f9800011 (885f7c01) ---[ end trace 7e42dd9a39ed2281 ]---
Fix by using mt76devphy() which will map bandidx to the correct phy for all hardware combinations.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix oops on non-dbdc mt7986
mt7915bandconfig() sets bandidx = 1 on the main phy for mt7986 with MT7975ONEADIE or MT7976ONEADIE.
Commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status") introduced a dereference of the phys array indirectly indexed by bandidx via wcid->phyidx in mt76wcidcleanup(). This caused the following Oops on affected mt7986 devices:
Unable to handle kernel read from unreadable memory at virtual address 0000000000000024 Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005 CM = 0, WnR = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000 [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: ... mt7915e mt76connaclib mt76 mac80211 cfg80211 ... CPU: 2 PID: 1631 Comm: hostapd Not tainted 5.15.150 #0 Hardware name: ZyXEL EX5700 (Telenor) (DT) pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mt76wcidcleanup+0x84/0x22c [mt76] lr : mt76wcidcleanup+0x64/0x22c [mt76] sp : ffffffc00a803700 x29: ffffffc00a803700 x28: ffffff80008f7300 x27: ffffff80003f3c00 x26: ffffff80000a7880 x25: ffffffc008c26e00 x24: 0000000000000001 x23: ffffffc000a68114 x22: 0000000000000000 x21: ffffff8004172cc8 x20: ffffffc00a803748 x19: ffffff8004152020 x18: 0000000000000000 x17: 00000000000017c0 x16: ffffffc008ef5000 x15: 0000000000000be0 x14: ffffff8004172e28 x13: ffffff8004172e28 x12: 0000000000000000 x11: 0000000000000000 x10: ffffff8004172e30 x9 : ffffff8004172e28 x8 : 0000000000000000 x7 : ffffff8004156020 x6 : 0000000000000000 x5 : 0000000000000031 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : ffffff80008f7300 x0 : 0000000000000024 Call trace: mt76wcidcleanup+0x84/0x22c [mt76] mt76staremove+0x70/0xbc [mt76] mt76stastate+0x8c/0x1a4 [mt76] mt7915eepromgetpowerdelta+0x11e4/0x23a0 [mt7915e] drvstastate+0x144/0x274 [mac80211] stainfomovestate+0x1cc/0x2a4 [mac80211] stasetsinfo+0xaf8/0xc24 [mac80211] stainfodestroyaddrbss+0x4c/0x6c [mac80211]
ieee80211colorchangefinish+0x1c08/0x1e70 [mac80211] cfg80211checkstationchange+0x1360/0x4710 [cfg80211] genlfamilyrcvmsgdoit+0xb4/0x110 genlrcvmsg+0xd0/0x1bc netlinkrcvskb+0x58/0x120 genlrcv+0x34/0x50 netlinkunicast+0x1f0/0x2ec netlinksendmsg+0x198/0x3d0 syssendmsg+0x1b0/0x210 syssendmsg+0x80/0xf0 syssendmsg+0x44/0xa0 arm64syssendmsg+0x20/0x30 invokesyscall.constprop.0+0x4c/0xe0 doel0svc+0x40/0xd0 el0svc+0x14/0x4c el0t64synchandler+0x100/0x110 el0t64sync+0x15c/0x160 Code: d2800002 910092c0 52800023 f9800011 (885f7c01) ---[ end trace 7e42dd9a39ed2281 ]---
Fix by using mt76devphy() which will map bandidx to the correct phy for all hardware combinations.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47715?
CVE-2024-47715 has a moderate severity level due to its impact on device stability.
How do I fix CVE-2024-47715?
To fix CVE-2024-47715, upgrade to the patched versions of the Linux kernel listed in the advisory.
Which versions of the Linux kernel are affected by CVE-2024-47715?
CVE-2024-47715 affects Linux kernel versions between 5.10.223-1 and 6.6.54, along with versions between 6.7 and 6.11.2.
What specific issue does CVE-2024-47715 address?
CVE-2024-47715 resolves an oops error on the non-dbdc mt7986 due to incorrect band index configuration.
Is there a specific commit associated with the resolution of CVE-2024-47715?
Yes, the issue was resolved in commit 0335c034e726 in the Linux kernel.