In the Linux kernel, the following vulnerability has been resolved:
can: mcp251xfd: fix infinite loop when xmit fails
When the mcp251xfdstartxmit() function fails, the driver stops processing messages, and the interrupt routine does not return, running indefinitely even after killing the running application.
Error messages: [ 441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfdstartxmit: -16 [ 441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, teftail=0x000017cf, tefhead=0x000017d0, tx_head=0x000017d3). ... and repeat forever.
The issue can be triggered when multiple devices share the same SPI interface. And there is concurrent access to the bus.
The problem occurs because txring->head increments even if mcp251xfdstartxmit() fails. Consequently, the driver skips one TX package while still expecting a response in mcp251xfdhandletefifone().
Resolve the issue by starting a workqueue to write the tx obj synchronously if err = -EBUSY. In case of another error, decrement tx_ring->head, remove skb from the echo stack, and drop the message.
[mkl: use more imperative wording in patch description]
{ "vanir_signatures": [ { "digest": { "length": 1219.0, "function_hash": "18689074015261410142861793674822854745" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8fb63e46c884c898a38f061c2330f7729e75510", "signature_type": "Function", "target": { "function": "mcp251xfd_open", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-0096471c" }, { "digest": { "line_hashes": [ "197648682311536828386834263432770756324", "25845601783404051182447469942807963200", "278024461884638604419827086433185124408", "129749050648720035245481983624795749802", "101714125240763769276736198062055510405", "101357547443707927087161797263332370844", "15858746697893835161018281919539387695", "195091867306637976758329957531011019529", "15716026463803900330627165855493918968", "19955796583538618493125652790385145071", "76388229063706490305278773202940279015", "125908654647892566075813563307771454596", "270059537056652046507327984443202729373", "105105400024662164199397969252358709252", "229900331326684046347877827320955243227", "275090423381506063105360152220420581578" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c6b4afa59c2fb4d1759235f866d8caed2aa4729", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-0ba0f856" }, { "digest": { "line_hashes": [ "285241193485979800084489886293616891704", "272430983808496939263883625655740420538", "249716946719441802657576625267662555792", "165710025763418222223630860950561099320", "141268220190281585347966334898465503740", "76062087259270941230683306177810291853" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e72558c1711d524e3150103739ddd06650e291b", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd.h" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-21421ba4" }, { "digest": { "length": 1219.0, "function_hash": "18689074015261410142861793674822854745" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c6b4afa59c2fb4d1759235f866d8caed2aa4729", "signature_type": "Function", "target": { "function": "mcp251xfd_open", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-2dde3276" }, { "digest": { "length": 745.0, "function_hash": "213121817809268727351890065969990283938" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c6b4afa59c2fb4d1759235f866d8caed2aa4729", "signature_type": "Function", "target": { "function": "mcp251xfd_start_xmit", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-50adcad5" }, { "digest": { "length": 1219.0, "function_hash": "18689074015261410142861793674822854745" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e72558c1711d524e3150103739ddd06650e291b", "signature_type": "Function", "target": { "function": "mcp251xfd_open", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-6afff65a" }, { "digest": { "line_hashes": [ "285241193485979800084489886293616891704", "272430983808496939263883625655740420538", "249716946719441802657576625267662555792", "165710025763418222223630860950561099320", "141268220190281585347966334898465503740", "76062087259270941230683306177810291853" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c6b4afa59c2fb4d1759235f866d8caed2aa4729", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd.h" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-6b17985e" }, { "digest": { "length": 745.0, "function_hash": "213121817809268727351890065969990283938" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e72558c1711d524e3150103739ddd06650e291b", "signature_type": "Function", "target": { "function": "mcp251xfd_start_xmit", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-6df91f8a" }, { "digest": { "length": 474.0, "function_hash": "137901733592837283551043546995812449161" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f926c022ebaabf7963bebf89a97201d66978a025", "signature_type": "Function", "target": { "function": "mcp251xfd_stop", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-70c8552b" }, { "digest": { "line_hashes": [ "151201369741532948331907799151914981606", "269677415599025565744980620517182135542", "262461281105790762736965603308514806362", "192709765133574676070236947788285643832", "164149953940047070501529826818159773916", "283214861427068980052732126784482098966", "124388480069241006081841606370447839239", "184598766090512427760607322941917255267", "297523266493255491358361122983255029930", "316661238373268213275690498660039387683", "136658497432200876146240328443336263119", "35944883011114628655347985309381416450", "238496505570658316221639628756455289756", "30759389564152621580120474567362914281", "296913699239436971746160589889153997735", "322193411047204042420822206825977537588", "233227856985257488458400753227970435153" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c6b4afa59c2fb4d1759235f866d8caed2aa4729", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-918a7a1c" }, { "digest": { "line_hashes": [ "197648682311536828386834263432770756324", "25845601783404051182447469942807963200", "278024461884638604419827086433185124408", "129749050648720035245481983624795749802", "101714125240763769276736198062055510405", "101357547443707927087161797263332370844", "15858746697893835161018281919539387695", "195091867306637976758329957531011019529", "15716026463803900330627165855493918968", "19955796583538618493125652790385145071", "76388229063706490305278773202940279015", "125908654647892566075813563307771454596", "270059537056652046507327984443202729373", "105105400024662164199397969252358709252", "229900331326684046347877827320955243227", "275090423381506063105360152220420581578" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f926c022ebaabf7963bebf89a97201d66978a025", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-94945f35" }, { "digest": { "length": 474.0, "function_hash": "137901733592837283551043546995812449161" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8fb63e46c884c898a38f061c2330f7729e75510", "signature_type": "Function", "target": { "function": "mcp251xfd_stop", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-94a9ca31" }, { "digest": { "length": 745.0, "function_hash": "213121817809268727351890065969990283938" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f926c022ebaabf7963bebf89a97201d66978a025", "signature_type": "Function", "target": { "function": "mcp251xfd_start_xmit", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-af60f8f4" }, { "digest": { "length": 474.0, "function_hash": "137901733592837283551043546995812449161" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e72558c1711d524e3150103739ddd06650e291b", "signature_type": "Function", "target": { "function": "mcp251xfd_stop", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-b2a715fc" }, { "digest": { "line_hashes": [ "151201369741532948331907799151914981606", "269677415599025565744980620517182135542", "262461281105790762736965603308514806362", "192709765133574676070236947788285643832", "164149953940047070501529826818159773916", "283214861427068980052732126784482098966", "124388480069241006081841606370447839239", "184598766090512427760607322941917255267", "297523266493255491358361122983255029930", "316661238373268213275690498660039387683", "136658497432200876146240328443336263119", "35944883011114628655347985309381416450", "238496505570658316221639628756455289756", "30759389564152621580120474567362914281", "296913699239436971746160589889153997735", "322193411047204042420822206825977537588", "233227856985257488458400753227970435153" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8fb63e46c884c898a38f061c2330f7729e75510", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-c208e246" }, { "digest": { "line_hashes": [ "285241193485979800084489886293616891704", "272430983808496939263883625655740420538", "249716946719441802657576625267662555792", "165710025763418222223630860950561099320", "141268220190281585347966334898465503740", "76062087259270941230683306177810291853" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f926c022ebaabf7963bebf89a97201d66978a025", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd.h" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-c273bb3f" }, { "digest": { "line_hashes": [ "197648682311536828386834263432770756324", "25845601783404051182447469942807963200", "278024461884638604419827086433185124408", "129749050648720035245481983624795749802", "101714125240763769276736198062055510405", "101357547443707927087161797263332370844", "15858746697893835161018281919539387695", "195091867306637976758329957531011019529", "15716026463803900330627165855493918968", "19955796583538618493125652790385145071", "76388229063706490305278773202940279015", "125908654647892566075813563307771454596", "270059537056652046507327984443202729373", "105105400024662164199397969252358709252", "229900331326684046347877827320955243227", "275090423381506063105360152220420581578" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e72558c1711d524e3150103739ddd06650e291b", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-c62eace8" }, { "digest": { "line_hashes": [ "285241193485979800084489886293616891704", "272430983808496939263883625655740420538", "249716946719441802657576625267662555792", "165710025763418222223630860950561099320", "141268220190281585347966334898465503740", "76062087259270941230683306177810291853" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8fb63e46c884c898a38f061c2330f7729e75510", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd.h" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-d64e5c7d" }, { "digest": { "length": 745.0, "function_hash": "213121817809268727351890065969990283938" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8fb63e46c884c898a38f061c2330f7729e75510", "signature_type": "Function", "target": { "function": "mcp251xfd_start_xmit", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-d8a76750" }, { "digest": { "line_hashes": [ "151201369741532948331907799151914981606", "269677415599025565744980620517182135542", "262461281105790762736965603308514806362", "192709765133574676070236947788285643832", "164149953940047070501529826818159773916", "283214861427068980052732126784482098966", "124388480069241006081841606370447839239", "184598766090512427760607322941917255267", "297523266493255491358361122983255029930", "316661238373268213275690498660039387683", "136658497432200876146240328443336263119", "35944883011114628655347985309381416450", "238496505570658316221639628756455289756", "30759389564152621580120474567362914281", "296913699239436971746160589889153997735", "322193411047204042420822206825977537588", "233227856985257488458400753227970435153" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f926c022ebaabf7963bebf89a97201d66978a025", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-d9f398a8" }, { "digest": { "line_hashes": [ "197648682311536828386834263432770756324", "25845601783404051182447469942807963200", "278024461884638604419827086433185124408", "129749050648720035245481983624795749802", "101714125240763769276736198062055510405", "101357547443707927087161797263332370844", "15858746697893835161018281919539387695", "195091867306637976758329957531011019529", "15716026463803900330627165855493918968", "19955796583538618493125652790385145071", "76388229063706490305278773202940279015", "125908654647892566075813563307771454596", "270059537056652046507327984443202729373", "105105400024662164199397969252358709252", "229900331326684046347877827320955243227", "275090423381506063105360152220420581578" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8fb63e46c884c898a38f061c2330f7729e75510", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-dd578383" }, { "digest": { "length": 474.0, "function_hash": "137901733592837283551043546995812449161" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c6b4afa59c2fb4d1759235f866d8caed2aa4729", "signature_type": "Function", "target": { "function": "mcp251xfd_stop", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-e191d9d4" }, { "digest": { "line_hashes": [ "151201369741532948331907799151914981606", "269677415599025565744980620517182135542", "262461281105790762736965603308514806362", "192709765133574676070236947788285643832", "164149953940047070501529826818159773916", "283214861427068980052732126784482098966", "124388480069241006081841606370447839239", "184598766090512427760607322941917255267", "297523266493255491358361122983255029930", "316661238373268213275690498660039387683", "136658497432200876146240328443336263119", "35944883011114628655347985309381416450", "238496505570658316221639628756455289756", "30759389564152621580120474567362914281", "296913699239436971746160589889153997735", "322193411047204042420822206825977537588", "233227856985257488458400753227970435153" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e72558c1711d524e3150103739ddd06650e291b", "signature_type": "Line", "target": { "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-e68c876a" }, { "digest": { "length": 1219.0, "function_hash": "18689074015261410142861793674822854745" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f926c022ebaabf7963bebf89a97201d66978a025", "signature_type": "Function", "target": { "function": "mcp251xfd_open", "file": "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-41088-ec3635d2" } ] }