CVE-2024-42319

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()

When mtk-cmdq unbinds, a WARN_ON message with condition

pm_runtime_get_sync() < 0 occurs.

According to the call tracei below:

cmdq_mbox_shutdown

mbox_free_channel

mbox_controller_unregister

__devm_mbox_controller_unregister

...

The root cause can be deduced to be calling pm_runtime_get_sync() after

calling pm_runtime_disable() as observed below:

1. CMDQ driver uses devm_mbox_controller_register() in cmdq_probe()

to bind the cmdq device to the mbox_controller, so

devm_mbox_controller_unregister() will automatically unregister

the device bound to the mailbox controller when the device-managed

resource is removed. That means devm_mbox_controller_unregister()

and cmdq_mbox_shoutdown() will be called after cmdq_remove().

2. CMDQ driver also uses devm_pm_runtime_enable() in cmdq_probe() after

devm_mbox_contr

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References