linux-cve-announce - CVE-2024-49963: mailbox: bcm2835: Fix timeout during suspend mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024102132-CVE-2024-49963-a198@gregkh>
Date: Mon, 21 Oct 2024 20:02:51 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-49963: mailbox: bcm2835: Fix timeout during suspend mode

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mailbox: bcm2835: Fix timeout during suspend mode

During noirq suspend phase the Raspberry Pi power driver suffer of
firmware property timeouts. The reason is that the IRQ of the underlying
BCM2835 mailbox is disabled and rpi_firmware_property_list() will always
run into a timeout [1].

Since the VideoCore side isn't consider as a wakeup source, set the
IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled
during suspend-resume cycle.

[1]
PM: late suspend of devices complete after 1.754 msecs
WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128
 rpi_firmware_property_list+0x204/0x22c
Firmware transaction 0x00028001 timeout
Modules linked in:
CPU: 0 PID: 438 Comm: bash Tainted: G         C         6.9.3-dirty #17
Hardware name: BCM2835
Call trace:
unwind_backtrace from show_stack+0x18/0x1c
show_stack from dump_stack_lvl+0x34/0x44
dump_stack_lvl from __warn+0x88/0xec
__warn from warn_slowpath_fmt+0x7c/0xb0
warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c
rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c
rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0
rpi_firmware_set_power from _genpd_power_off+0xe4/0x148
_genpd_power_off from genpd_sync_power_off+0x7c/0x11c
genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0
genpd_finish_suspend from dpm_run_callback+0x78/0xd0
dpm_run_callback from device_suspend_noirq+0xc0/0x238
device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168
dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac
suspend_devices_and_enter from pm_suspend+0x254/0x2e4
pm_suspend from state_store+0xa8/0xd4
state_store from kernfs_fop_write_iter+0x154/0x1a0
kernfs_fop_write_iter from vfs_write+0x12c/0x184
vfs_write from ksys_write+0x78/0xc0
ksys_write from ret_fast_syscall+0x0/0x54
Exception stack(0xcc93dfa8 to 0xcc93dff0)
[...]
PM: noirq suspend of devices complete after 3095.584 msecs

The Linux kernel CVE team has assigned CVE-2024-49963 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.2 with commit 0bae6af6d704 and fixed in 5.10.227 with commit 32ee78823dea
	Issue introduced in 4.2 with commit 0bae6af6d704 and fixed in 5.15.168 with commit df293ea78740
	Issue introduced in 4.2 with commit 0bae6af6d704 and fixed in 6.1.113 with commit 90320cfc07b7
	Issue introduced in 4.2 with commit 0bae6af6d704 and fixed in 6.6.55 with commit 10a58555e0bb
	Issue introduced in 4.2 with commit 0bae6af6d704 and fixed in 6.10.14 with commit e65a9af05a0b
	Issue introduced in 4.2 with commit 0bae6af6d704 and fixed in 6.11.3 with commit dfeb67b2194e
	Issue introduced in 4.2 with commit 0bae6af6d704 and fixed in 6.12-rc1 with commit dc09f007caed

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-49963
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/mailbox/bcm2835-mailbox.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/32ee78823dea2d54adaf6e05f86622eba359e091
	https://git.kernel.org/stable/c/df293ea78740a41384d648041f38f645700288e1
	https://git.kernel.org/stable/c/90320cfc07b7d6e7a58fd8168f6380ec52ff0251
	https://git.kernel.org/stable/c/10a58555e0bb5cc4673c8bb73b8afc5fa651f0ac
	https://git.kernel.org/stable/c/e65a9af05a0b59ebeba28e5e82265a233db7bc27
	https://git.kernel.org/stable/c/dfeb67b2194ecc55ef8065468c5adda3cdf59114
	https://git.kernel.org/stable/c/dc09f007caed3b2f6a3b6bd7e13777557ae22bfd