CVE-2024-49963: mailbox: bcm2835: Fix timeout during suspend mode
In the Linux kernel, the following vulnerability has been resolved:
mailbox: bcm2835: Fix timeout during suspend mode
During noirq suspend phase the Raspberry Pi power driver suffer of firmware property timeouts. The reason is that the IRQ of the underlying BCM2835 mailbox is disabled and rpifirmwarepropertylist() will always run into a timeout [1].
Since the VideoCore side isn't consider as a wakeup source, set the IRQFNOSUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle.
[1] PM: late suspend of devices complete after 1.754 msecs WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpifirmwarepropertylist+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwindbacktrace from showstack+0x18/0x1c showstack from dumpstacklvl+0x34/0x44 dumpstacklvl from warn+0x88/0xec warn from warnslowpathfmt+0x7c/0xb0 warnslowpathfmt from rpifirmwarepropertylist+0x204/0x22c rpifirmwarepropertylist from rpifirmwareproperty+0x68/0x8c rpifirmwareproperty from rpifirmwaresetpower+0x54/0xc0 rpifirmwaresetpower from genpdpoweroff+0xe4/0x148 genpdpoweroff from genpdsyncpoweroff+0x7c/0x11c genpdsyncpoweroff from genpdfinishsuspend+0xcc/0xe0 genpdfinishsuspend from dpmruncallback+0x78/0xd0 dpmruncallback from devicesuspendnoirq+0xc0/0x238 devicesuspendnoirq from dpmsuspendnoirq+0xb0/0x168 dpmsuspendnoirq from suspenddevicesandenter+0x1b8/0x5ac suspenddevicesandenter from pmsuspend+0x254/0x2e4 pmsuspend from statestore+0xa8/0xd4 statestore from kernfsfopwriteiter+0x154/0x1a0 kernfsfopwriteiter from vfswrite+0x12c/0x184 vfswrite from ksyswrite+0x78/0xc0 ksyswrite from retfastsyscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0) [...] PM: noirq suspend of devices complete after 3095.584 msecs
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49963?
CVE-2024-49963 has been rated as a medium severity vulnerability due to the potential impact on system stability during the noirq suspend phase.
How do I fix CVE-2024-49963?
To fix CVE-2024-49963, update the Linux kernel to a version above 5.10.227, 5.15.168, 6.1.113, 6.6.55, or 6.10.14 based on your current version.
Which versions of the Linux kernel are affected by CVE-2024-49963?
CVE-2024-49963 affects Linux kernel versions between 4.2 and 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, and 6.11 to 6.11.3.
Is CVE-2024-49963 a denial of service vulnerability?
CVE-2024-49963 does not represent a denial of service vulnerability but can affect system performance during suspend phases.
Do I need to take immediate action on CVE-2024-49963?
If your systems are running an affected version of the Linux kernel, you should prioritize upgrading as soon as possible to mitigate the timeout issues.