CVE-2024-58097

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix RCU stall while reaping monitor destination ring

While processing the monitor destination ring, MSDUs are reaped from the

link descriptor based on the corresponding buf_id.

However, sometimes the driver cannot obtain a valid buffer corresponding

to the buf_id received from the hardware. This causes an infinite loop

in the destination processing, resulting in a kernel crash.

kernel log:

ath11k_pci 0000:58:00.0: data msdu_pop: invalid buf_id 309

ath11k_pci 0000:58:00.0: data dp_rx_monitor_link_desc_return failed

ath11k_pci 0000:58:00.0: data msdu_pop: invalid buf_id 309

ath11k_pci 0000:58:00.0: data dp_rx_monitor_link_desc_return failed

Fix this by skipping the problematic buf_id and reaping the next entry,

replacing the break with the next MSDU processing.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QC

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References