CVE-2024-41036

In the Linux kernel, the following vulnerability has been resolved:

net: ks8851: Fix deadlock with the SPI chip variant

When SMP is enabled and spinlocks are actually functional then there is a deadlock with the 'statelock' spinlock between ks8851_start_xmit_spi and ks8851_irq:

watchdog: BUG: soft lockup - CPU#0 stuck for 27s!
call trace:
  queued_spin_lock_slowpath+0x100/0x284
  do_raw_spin_lock+0x34/0x44
  ks8851_start_xmit_spi+0x30/0xb8
  ks8851_start_xmit+0x14/0x20
  netdev_start_xmit+0x40/0x6c
  dev_hard_start_xmit+0x6c/0xbc
  sch_direct_xmit+0xa4/0x22c
  __qdisc_run+0x138/0x3fc
  qdisc_run+0x24/0x3c
  net_tx_action+0xf8/0x130
  handle_softirqs+0x1ac/0x1f0
  __do_softirq+0x14/0x20
  ____do_softirq+0x10/0x1c
  call_on_irq_stack+0x3c/0x58
  do_softirq_own_stack+0x1c/0x28
  __irq_exit_rcu+0x54/0x9c
  irq_exit_rcu+0x10/0x1c
  el1_interrupt+0x38/0x50
  el1h_64_irq_handler+0x18/0x24
  el1h_64_irq+0x64/0x68
  __netif_schedule+0x6c/0x80
  netif_tx_wake_queue+0x38/0x48
  ks8851_irq+0xb8/0x2c8
  irq_thread_fn+0x2c/0x74
  irq_thread+0x10c/0x1b0
  kthread+0xc8/0xd8
  ret_from_fork+0x10/0x20

This issue has not been identified earlier because tests were done on a device with SMP disabled and so spinlocks were actually NOPs.

Now use spin_(un)lock_bh for TX queue related locking to avoid execution of softirq work synchronously that would lead to a deadlock.

A low impact deadlock was found in the Linux kernel ks8851 network driver for the SPI chip variant. When SMP is enabled and spinlocks are functional, the driver's 'statelock' spinlock can deadlock between the ks8851_start_xmit_spi transmit path and the ks8851_irq interrupt handler, resulting in a soft lockup (watchdog BUG: soft lockup, CPU stuck for 27s) and a denial of service of network traffic on the ks8851 SPI interface. Red Hat Product Security rated this flaw Low impact (CVSS 4.4, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) because the issue is limited to availability, requires a system with the ks8851 SPI variant hardware, and per the Red Hat assessment requires high privileges locally. According to the current affectedness records, Red Hat Enterprise Linux 6, 7, 8, and 9 (kernel and kernel-rt, across their update streams) and the Hosted OpenShift Clusters (OSD4 and ARO4) are not affected by this flaw; only the Fedora community kernel (fedora-all) is affected, and a fix is being pursued through the community kernel (DELEGATED). The CVE.org record scores this flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with a network attack vector, which differs significantly from the Red Hat assessment: the verified defect is in a locally attached SPI network device driver and does not support the remote attack path implied by the upstream score.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.