Bug 2313139 (CVE-2024-46791) - CVE-2024-46791 kernel: can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
Summary: CVE-2024-46791 kernel: can: mcp251x: fix deadlock if an interrupt occurs duri...
Keywords:
Status: NEW
Alias: CVE-2024-46791
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2313261
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-09-18 08:23 UTC by OSIDB Bzimport
Modified: 2024-09-18 12:30 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-09-18 08:23:13 UTC
In the Linux kernel, the following vulnerability has been resolved:

can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open

The mcp251x_hw_wake() function is called with the mpc_lock mutex held and
disables the interrupt handler so that no interrupts can be processed while
waking the device. If an interrupt has already occurred then waiting for
the interrupt handler to complete will deadlock because it will be trying
to acquire the same mutex.

CPU0                           CPU1
----                           ----
mcp251x_open()
 mutex_lock(&priv->mcp_lock)
  request_threaded_irq()
                               <interrupt>
                               mcp251x_can_ist()
                                mutex_lock(&priv->mcp_lock)
  mcp251x_hw_wake()
   disable_irq() <-- deadlock

Use disable_irq_nosync() instead because the interrupt handler does
everything while holding the mutex so it doesn't matter if it's still
running.


Note You need to log in before you can comment on or make changes to this bug.