CVE-2024-40912

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()

The ieee80211_sta_ps_deliver_wakeup() function takes sta->ps_lock to

synchronizes with ieee80211_tx_h_unicast_ps_buf() which is called from

softirq context. However using only spin_lock() to get sta->ps_lock in

ieee80211_sta_ps_deliver_wakeup() does not prevent softirq to execute

on this same CPU, to run ieee80211_tx_h_unicast_ps_buf() and try to

take this same lock ending in deadlock. Below is an example of rcu stall

that arises in such situation.

rcu: INFO: rcu_sched self-detected stall on CPU

rcu: 2-....: (42413413 ticks this GP) idle=b154/1/0x4000000000000000 softirq=1763/1765 fqs=21206996

rcu: (t=42586894 jiffies g=2057 q=362405 ncpus=4)

CPU: 2 PID: 719 Comm: wpa_supplicant Tainted: G W 6.4.0-02158-g1b062f552873 #742

Hardware name: RPT (r1) (DT)

pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : queu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References