CVE-2024-38600

In sndcarddisconnect(), we set card->shutdown flag at the beginning, call callbacks and do sync for card->powerrefsleep waiters at the end. The callback may delete a kctl element, and this can lead to a deadlock when the device was in the suspended state. Namely:

A process waits for the power up at sndpowerrefandwait() in sndctlinfo() or read/write() inside card->controls_rwsem.
The system gets disconnected meanwhile, and the driver tries to delete a kctl via sndctlremove*(); it tries to take card->controls_rwsem again, but this is already locked by the above. Since the sleeper isn't woken up, this deadlocks.

An easy fix is to wake up sleepers before processing the driver disconnect callbacks but right after setting the card->shutdown flag. Then all sleepers will abort immediately, and the code flows again.

So, basically this patch moves the waitevent() call at the right timing. While we're at it, just to be sure, call waiteventall() instead of waitevent(), although we don't use exclusive events on this queue for now.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e94fdbd7b25d87e64688bb109e2c550217a4c879

Fixed

ff80185e7b7b547a0911fcfc8aefc61c3e8304d7

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e94fdbd7b25d87e64688bb109e2c550217a4c879

Fixed

c2fb439f4f1425a961d20bec818fed2c2d9ef70a

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e94fdbd7b25d87e64688bb109e2c550217a4c879

Fixed

2f103287ef7960854808930499d1181bd0145d68

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e94fdbd7b25d87e64688bb109e2c550217a4c879

Fixed

88ce3fe255d58a93624b467af036dc3519f309c7

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e94fdbd7b25d87e64688bb109e2c550217a4c879

Fixed

6b55e879e7bd023a03888fc6c8339edf82f576f4

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e94fdbd7b25d87e64688bb109e2c550217a4c879

Fixed

87988a534d8e12f2e6fc01fe63e6c1925dc5307c

Affected versions

v5.*

v5.13

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.15.1

v5.15.10

v5.15.100

v5.15.101

v5.15.102

v5.15.103

v5.15.104

v5.15.105

v5.15.106

v5.15.107

v5.15.108

v5.15.109

v5.15.11

v5.15.110

v5.15.111

v5.15.112

v5.15.113

v5.15.114

v5.15.115

v5.15.116

v5.15.117

v5.15.118

v5.15.119

v5.15.12

v5.15.120

v5.15.121

v5.15.122

v5.15.123

v5.15.124

v5.15.125

v5.15.126

v5.15.127

v5.15.128

v5.15.129

v5.15.13

v5.15.130

v5.15.131

v5.15.132

v5.15.133

v5.15.134

v5.15.135

v5.15.136

v5.15.137

v5.15.138

v5.15.139

v5.15.14

v5.15.140

v5.15.141

v5.15.142

v5.15.143

v5.15.144

v5.15.145

v5.15.146

v5.15.147

v5.15.148

v5.15.149

v5.15.15

v5.15.150

v5.15.151

v5.15.152

v5.15.153

v5.15.154

v5.15.155

v5.15.156

v5.15.157

v5.15.158

v5.15.159

v5.15.16

v5.15.160

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.20

v5.15.21

v5.15.22

v5.15.23

v5.15.24

v5.15.25

v5.15.26

v5.15.27

v5.15.28

v5.15.29

v5.15.3

v5.15.30

v5.15.31

v5.15.32

v5.15.33

v5.15.34

v5.15.35

v5.15.36

v5.15.37

v5.15.38

v5.15.39

v5.15.4

v5.15.40

v5.15.41

v5.15.42

v5.15.43

v5.15.44

v5.15.45

v5.15.46

v5.15.47

v5.15.48

v5.15.49

v5.15.5

v5.15.50

v5.15.51

v5.15.52

v5.15.53

v5.15.54

v5.15.55

v5.15.56

v5.15.57

v5.15.58

v5.15.59

v5.15.6

v5.15.60

v5.15.61

v5.15.62

v5.15.63

v5.15.64

v5.15.65

v5.15.66

v5.15.67

v5.15.68

v5.15.69

v5.15.7

v5.15.70

v5.15.71

v5.15.72

v5.15.73

v5.15.74

v5.15.75

v5.15.76

v5.15.77

v5.15.78

v5.15.79

v5.15.8

v5.15.80

v5.15.81

v5.15.82

v5.15.83

v5.15.84

v5.15.85

v5.15.86

v5.15.87

v5.15.88

v5.15.89

v5.15.9

v5.15.90

v5.15.91

v5.15.92

v5.15.93

v5.15.94

v5.15.95

v5.15.96

v5.15.97

v5.15.98

v5.15.99

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.45

v6.1.46

v6.1.47

v6.1.48

v6.1.49

v6.1.5

v6.1.50

v6.1.51

v6.1.52

v6.1.53

v6.1.54

v6.1.55

v6.1.56

v6.1.57

v6.1.58

v6.1.59

v6.1.6

v6.1.60

v6.1.61

v6.1.62

v6.1.63

v6.1.64

v6.1.65

v6.1.66

v6.1.67

v6.1.68

v6.1.69

v6.1.7

v6.1.70

v6.1.71

v6.1.72

v6.1.73

v6.1.74

v6.1.75

v6.1.76

v6.1.77

v6.1.78

v6.1.79

v6.1.8

v6.1.80

v6.1.81

v6.1.82

v6.1.83

v6.1.84

v6.1.85

v6.1.86

v6.1.87

v6.1.88

v6.1.89

v6.1.9

v6.1.90

v6.1.91

v6.1.92

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.6.1

v6.6.10

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.15

v6.6.16

v6.6.17

v6.6.18

v6.6.19

v6.6.2

v6.6.20

v6.6.21

v6.6.22

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.3

v6.6.30

v6.6.31

v6.6.32

v6.6.4

v6.6.5

v6.6.6

v6.6.7

v6.6.8

v6.6.9

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.8.1

v6.8.10

v6.8.11

v6.8.2

v6.8.3

v6.8.4

v6.8.5

v6.8.6

v6.8.7

v6.8.8

v6.8.9

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

v6.9.1

v6.9.2

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88ce3fe255d58a93624b467af036dc3519f309c7",
        "signature_version": "v1",
        "target": {
            "function": "snd_card_disconnect",
            "file": "sound/core/init.c"
        },
        "digest": {
            "function_hash": "154310753332007730723797799070192815864",
            "length": 1111.0
        },
        "id": "CVE-2024-38600-0556e8f7"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88ce3fe255d58a93624b467af036dc3519f309c7",
        "signature_version": "v1",
        "target": {
            "file": "sound/core/init.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "137581069816494665222056956693981541070",
                "130819979136910441094071548685022026836",
                "24101907280299693807086210954258082878",
                "201589475621352984230604831852134724377",
                "287173131650634605955893763375573314936",
                "185994127924206038882115071382528558412",
                "34702698587714650497563565350015893411"
            ]
        },
        "id": "CVE-2024-38600-0b60842c"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2fb439f4f1425a961d20bec818fed2c2d9ef70a",
        "signature_version": "v1",
        "target": {
            "file": "sound/core/init.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "137581069816494665222056956693981541070",
                "130819979136910441094071548685022026836",
                "24101907280299693807086210954258082878",
                "201589475621352984230604831852134724377",
                "287173131650634605955893763375573314936",
                "185994127924206038882115071382528558412",
                "62550043640177325691795497885748932367"
            ]
        },
        "id": "CVE-2024-38600-11c8452d"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87988a534d8e12f2e6fc01fe63e6c1925dc5307c",
        "signature_version": "v1",
        "target": {
            "function": "snd_card_disconnect",
            "file": "sound/core/init.c"
        },
        "digest": {
            "function_hash": "215213030821357985619105287779159594837",
            "length": 1014.0
        },
        "id": "CVE-2024-38600-7ce02e14"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff80185e7b7b547a0911fcfc8aefc61c3e8304d7",
        "signature_version": "v1",
        "target": {
            "file": "sound/core/init.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "137581069816494665222056956693981541070",
                "130819979136910441094071548685022026836",
                "24101907280299693807086210954258082878",
                "201589475621352984230604831852134724377",
                "287173131650634605955893763375573314936",
                "185994127924206038882115071382528558412",
                "62550043640177325691795497885748932367"
            ]
        },
        "id": "CVE-2024-38600-7e7c5c48"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2fb439f4f1425a961d20bec818fed2c2d9ef70a",
        "signature_version": "v1",
        "target": {
            "function": "snd_card_disconnect",
            "file": "sound/core/init.c"
        },
        "digest": {
            "function_hash": "178191443929839993374447767364292633264",
            "length": 1133.0
        },
        "id": "CVE-2024-38600-9190e19b"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b55e879e7bd023a03888fc6c8339edf82f576f4",
        "signature_version": "v1",
        "target": {
            "function": "snd_card_disconnect",
            "file": "sound/core/init.c"
        },
        "digest": {
            "function_hash": "215213030821357985619105287779159594837",
            "length": 1014.0
        },
        "id": "CVE-2024-38600-9e964619"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff80185e7b7b547a0911fcfc8aefc61c3e8304d7",
        "signature_version": "v1",
        "target": {
            "function": "snd_card_disconnect",
            "file": "sound/core/init.c"
        },
        "digest": {
            "function_hash": "178191443929839993374447767364292633264",
            "length": 1133.0
        },
        "id": "CVE-2024-38600-a90054a9"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f103287ef7960854808930499d1181bd0145d68",
        "signature_version": "v1",
        "target": {
            "function": "snd_card_disconnect",
            "file": "sound/core/init.c"
        },
        "digest": {
            "function_hash": "154310753332007730723797799070192815864",
            "length": 1111.0
        },
        "id": "CVE-2024-38600-b2e24f43"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b55e879e7bd023a03888fc6c8339edf82f576f4",
        "signature_version": "v1",
        "target": {
            "file": "sound/core/init.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "307758563534831270745919343379163196689",
                "48796807435842534624852611057496320784",
                "170105126959592075942359236224653997898",
                "88458584989115404852810806208015403414",
                "340071220456803537696788556487029968759",
                "185994127924206038882115071382528558412",
                "34702698587714650497563565350015893411"
            ]
        },
        "id": "CVE-2024-38600-c702fb81"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87988a534d8e12f2e6fc01fe63e6c1925dc5307c",
        "signature_version": "v1",
        "target": {
            "file": "sound/core/init.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "307758563534831270745919343379163196689",
                "48796807435842534624852611057496320784",
                "170105126959592075942359236224653997898",
                "88458584989115404852810806208015403414",
                "340071220456803537696788556487029968759",
                "185994127924206038882115071382528558412",
                "34702698587714650497563565350015893411"
            ]
        },
        "id": "CVE-2024-38600-e710fb3f"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f103287ef7960854808930499d1181bd0145d68",
        "signature_version": "v1",
        "target": {
            "file": "sound/core/init.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "137581069816494665222056956693981541070",
                "130819979136910441094071548685022026836",
                "24101907280299693807086210954258082878",
                "201589475621352984230604831852134724377",
                "287173131650634605955893763375573314936",
                "185994127924206038882115071382528558412",
                "34702698587714650497563565350015893411"
            ]
        },
        "id": "CVE-2024-38600-e9061ba9"
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.14.0

Fixed

5.15.161

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.93

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.33

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.8.12

Type: ECOSYSTEM
Events: Introduced

6.9.0

Fixed

6.9.3