In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: use two-phase skb reclamation in ieee80211dostop()
Since '_devqueue_xmit()' should be called with interrupts enabled, the following backtrace:
ieee80211dostop() ... spinlockirqsave(&local->queuestopreasonlock, flags) ... ieee80211freetxskb() ieee80211reportusedskb() ieee80211reportackskb() cfg80211mgmttxstatusext() nl80211frametxstatus() genlmsgmulticastnetns() genlmsgmulticastnetnsfiltered() nlmsgmulticastfiltered() netlinkbroadcastfiltered() doonebroadcast() netlinkbroadcastdeliver() _netlinksendskb() netlinkdelivertap() _netlinkdelivertapskb() devqueuexmit() _devqueuexmit() ; with IRQS disabled ... spinunlockirqrestore(&local->queuestopreason_lock, flags)
issues the warning (as reported by syzbot reproducer):
WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 _localbhenableip+0xc3/0x120
Fix this by implementing a two-phase skb reclamation in 'ieee80211dostop()', where actual work is performed outside of a section with interrupts disabled.
[
{
"id": "CVE-2024-47713-04aadfdc",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"79524314295212412559294137980073825578",
"121304924324720018166963005501562002749",
"13473357954058356471402644835268682665",
"211180917071621382773867814678736734954",
"29438316732450294139432113494615429209",
"257629679250276714438476473471957029540",
"70370441131624661228295250295994691085",
"45287691057358119869531637715459284138",
"103541485520082591706769684743939868007",
"65284990813189174063006737979543391821",
"137224246528641524784751273655570730047",
"299783316029662947335885495989641307363",
"232404846400884735524787054724768381073",
"214797130503934677396713962359679393625",
"197006845710587707655951972967076343686",
"89880760902075184326570891919320531516",
"324289636507433887005237648687894415380",
"29237600169917894147025737204000749340"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db5ca4b42ccfa42d2af7b335ff12578e57775c02",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-07b62092",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "28859301297736428920577230173858454977",
"length": 5195.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad4b7068b101fbbb4a9ca4b99b25eb051a9482ec",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-0fa50603",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "284491953039127408874892599412097397173",
"length": 5311.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f232916fab67ca1c3425926df4a866e59ff26908",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-16df9582",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"79524314295212412559294137980073825578",
"121304924324720018166963005501562002749",
"13473357954058356471402644835268682665",
"211180917071621382773867814678736734954",
"29438316732450294139432113494615429209",
"257629679250276714438476473471957029540",
"70370441131624661228295250295994691085",
"45287691057358119869531637715459284138",
"103541485520082591706769684743939868007",
"65284990813189174063006737979543391821",
"137224246528641524784751273655570730047",
"299783316029662947335885495989641307363",
"232404846400884735524787054724768381073",
"214797130503934677396713962359679393625",
"197006845710587707655951972967076343686",
"89880760902075184326570891919320531516",
"324289636507433887005237648687894415380",
"29237600169917894147025737204000749340"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acb53a716e492a02479345157c43f21edc8bc64b",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-1bf24388",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "7446381813210249229239966696009254610",
"length": 5369.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07eb0bd7b0a8abed9d45e0f567c9af1dc83e5268",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-1fb37d25",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"79524314295212412559294137980073825578",
"121304924324720018166963005501562002749",
"13473357954058356471402644835268682665",
"211180917071621382773867814678736734954",
"29438316732450294139432113494615429209",
"257629679250276714438476473471957029540",
"70370441131624661228295250295994691085",
"45287691057358119869531637715459284138",
"103541485520082591706769684743939868007",
"65284990813189174063006737979543391821",
"137224246528641524784751273655570730047",
"299783316029662947335885495989641307363",
"232404846400884735524787054724768381073",
"214797130503934677396713962359679393625",
"197006845710587707655951972967076343686",
"89880760902075184326570891919320531516",
"324289636507433887005237648687894415380",
"29237600169917894147025737204000749340"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d301de12da6e1bb069a9835c38359b8e8135121",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-353f76b5",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "121231568187986548496756721294643052524",
"length": 5443.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db5ca4b42ccfa42d2af7b335ff12578e57775c02",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-368ca58a",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"168170073871491071157990473245462307514",
"121304924324720018166963005501562002749",
"13473357954058356471402644835268682665",
"211180917071621382773867814678736734954",
"219605371456585696151950835852198080899",
"227733565024701470422112417097531263107",
"70370441131624661228295250295994691085",
"45287691057358119869531637715459284138",
"103541485520082591706769684743939868007",
"65284990813189174063006737979543391821",
"137224246528641524784751273655570730047",
"299783316029662947335885495989641307363",
"232404846400884735524787054724768381073",
"214797130503934677396713962359679393625",
"197006845710587707655951972967076343686",
"89880760902075184326570891919320531516",
"324289636507433887005237648687894415380",
"29237600169917894147025737204000749340"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f232916fab67ca1c3425926df4a866e59ff26908",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-598c6f54",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "273281988875954405213614709014444838937",
"length": 5229.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eab272972cffff9cd973b8e4055a8e81c64f7e6a",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-6d9ac9ce",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "12289044685920737827375278177002519924",
"length": 5223.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d301de12da6e1bb069a9835c38359b8e8135121",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-8bd957db",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"79524314295212412559294137980073825578",
"121304924324720018166963005501562002749",
"13473357954058356471402644835268682665",
"211180917071621382773867814678736734954",
"29438316732450294139432113494615429209",
"257629679250276714438476473471957029540",
"70370441131624661228295250295994691085",
"45287691057358119869531637715459284138",
"103541485520082591706769684743939868007",
"65284990813189174063006737979543391821",
"137224246528641524784751273655570730047",
"299783316029662947335885495989641307363",
"232404846400884735524787054724768381073",
"214797130503934677396713962359679393625",
"197006845710587707655951972967076343686",
"89880760902075184326570891919320531516",
"324289636507433887005237648687894415380",
"29237600169917894147025737204000749340"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eab272972cffff9cd973b8e4055a8e81c64f7e6a",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-c9b5fb69",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "16745730782535845743332364440761147006",
"length": 5158.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acb53a716e492a02479345157c43f21edc8bc64b",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-e70c0e0d",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"79524314295212412559294137980073825578",
"121304924324720018166963005501562002749",
"13473357954058356471402644835268682665",
"211180917071621382773867814678736734954",
"29438316732450294139432113494615429209",
"257629679250276714438476473471957029540",
"70370441131624661228295250295994691085",
"45287691057358119869531637715459284138",
"103541485520082591706769684743939868007",
"65284990813189174063006737979543391821",
"137224246528641524784751273655570730047",
"299783316029662947335885495989641307363",
"232404846400884735524787054724768381073",
"214797130503934677396713962359679393625",
"197006845710587707655951972967076343686",
"89880760902075184326570891919320531516",
"324289636507433887005237648687894415380",
"29237600169917894147025737204000749340"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad4b7068b101fbbb4a9ca4b99b25eb051a9482ec",
"signature_version": "v1"
},
{
"id": "CVE-2024-47713-fe0ae896",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"168170073871491071157990473245462307514",
"121304924324720018166963005501562002749",
"13473357954058356471402644835268682665",
"211180917071621382773867814678736734954",
"219605371456585696151950835852198080899",
"227733565024701470422112417097531263107",
"70370441131624661228295250295994691085",
"45287691057358119869531637715459284138",
"103541485520082591706769684743939868007",
"65284990813189174063006737979543391821",
"137224246528641524784751273655570730047",
"299783316029662947335885495989641307363",
"232404846400884735524787054724768381073",
"214797130503934677396713962359679393625",
"197006845710587707655951972967076343686",
"89880760902075184326570891919320531516",
"324289636507433887005237648687894415380",
"29237600169917894147025737204000749340"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07eb0bd7b0a8abed9d45e0f567c9af1dc83e5268",
"signature_version": "v1"
}
]