CVE-2023-54288

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fortify the spinlock against deadlock by interrupt

In the function ieee80211_tx_dequeue() there is a particular locking

sequence:

begin:

spin_lock(&local->queue_stop_reason_lock);

q_stopped = local->queue_stop_reasons[q];

spin_unlock(&local->queue_stop_reason_lock);

However small the chance (increased by ftracetest), an asynchronous

interrupt can occur in between of spin_lock() and spin_unlock(),

and the interrupt routine will attempt to lock the same

&local->queue_stop_reason_lock again.

This will cause a costly reset of the CPU and the wifi device or an

altogether hang in the single CPU and single core scenario.

The only remaining spin_lock(&local->queue_stop_reason_lock) that

did not disable interrupts was patched, which should prevent any

deadlocks on the same CPU/core and the same wifi device.

This is the probable trace of the deadlock:

kernel: ================================

kernel: WA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References