CVE-2024-56607

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-56607
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-56607.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-56607
Related
Published
2024-12-27T15:15:20Z
Modified
2025-01-09T17:49:15.344270Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix atomic calls in ath12kmacopsetbitrate_mask()

When I try to manually set bitrates:

iw wlan0 set bitrates legacy-2.4 1

I get sleeping from invalid context error, see below. Fix that by switching to use recently introduced ieee80211iteratestations_mtx().

Do note that WCN6855 firmware is still crashing, I'm not sure if that firmware even supports bitrate WMI commands and should we consider disabling ath12kmacopsetbitrate_mask() for WCN6855? But that's for another patch.

BUG: sleeping function called from invalid context at drivers/net/wireless/ath/ath12k/wmi.c:420 inatomic(): 0, irqsdisabled(): 0, nonblock: 0, pid: 2236, name: iw preemptcount: 0, expected: 0 RCU nest depth: 1, expected: 0 3 locks held by iw/2236: #0: ffffffffabc6f1d8 (cblock){++++}-{3:3}, at: genlrcv+0x14/0x40 #1: ffff888138410810 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211predoit+0x54d/0x800 [cfg80211] #2: ffffffffab2cfaa0 (rcureadlock){....}-{1:2}, at: ieee80211iteratestationsatomic+0x2f/0x200 [mac80211] CPU: 3 UID: 0 PID: 2236 Comm: iw Not tainted 6.11.0-rc7-wt-ath+ #1772 Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 Call Trace: <TASK> dumpstacklvl+0xa4/0xe0 dumpstack+0x10/0x20 mightresched+0x363/0x5a0 ? _allocskb+0x165/0x340 _mightsleep+0xad/0x160 ath12kwmicmdsend+0xb1/0x3d0 [ath12k] ? ath12kwmiinitwcn7850+0xa40/0xa40 [ath12k] ? _netdevallocskb+0x45/0x7b0 ? _asanmemset+0x39/0x40 ? ath12kwmiallocskb+0xf0/0x150 [ath12k] ? reacquireheldlocks+0x4d0/0x4d0 ath12kwmisetpeerparam+0x340/0x5b0 [ath12k] ath12kmacdisablepeerfixedrate+0xa3/0x110 [ath12k] ? ath12kmacvdevstop+0x4f0/0x4f0 [ath12k] ieee80211iteratestationsatomic+0xd4/0x200 [mac80211] ath12kmacopsetbitratemask+0x5d2/0x1080 [ath12k] ? ath12kmacvifchan+0x320/0x320 [ath12k] drvsetbitratemask+0x267/0x470 [mac80211] ieee80211setbitratemask+0x4cc/0x8a0 [mac80211] ? _thiscpupreemptcheck+0x13/0x20 nl80211settxbitratemask+0x2bc/0x530 [cfg80211] ? nl80211parsetxbitratemask+0x2320/0x2320 [cfg80211] ? tracecontentionend+0xef/0x140 ? rtnlunlock+0x9/0x10 ? nl80211predoit+0x557/0x800 [cfg80211] genlfamilyrcvmsgdoit+0x1f0/0x2e0 ? genlfamilyrcvmsgattrsparse.isra.0+0x250/0x250 ? nscapable+0x57/0xd0 genlfamilyrcvmsg+0x34c/0x600 ? genlfamilyrcvmsgdumpit+0x310/0x310 ? _lockacquire+0xc62/0x1de0 ? hesetmcsmask.isra.0+0x8d0/0x8d0 [cfg80211] ? nl80211parsetxbitratemask+0x2320/0x2320 [cfg80211] ? cfg80211externalauthrequest+0x690/0x690 [cfg80211] genlrcvmsg+0xa0/0x130 netlinkrcvskb+0x14c/0x400 ? genlfamilyrcvmsg+0x600/0x600 ? netlinkack+0xd70/0xd70 ? rwsemoptimisticspin+0x4f0/0x4f0 ? genlrcv+0x14/0x40 ? downreadkillable+0x580/0x580 ? netlinkdelivertap+0x13e/0x350 ? _thiscpupreemptcheck+0x13/0x20 genlrcv+0x23/0x40 netlinkunicast+0x45e/0x790 ? netlinkattachskb+0x7f0/0x7f0 netlinksendmsg+0x7eb/0xdb0 ? netlinkunicast+0x790/0x790 ? _thiscpupreemptcheck+0x13/0x20 ? selinuxsocketsendmsg+0x31/0x40 ? netlinkunicast+0x790/0x790 _socksendmsg+0xc9/0x160 _syssendmsg+0x620/0x990 ? kernelsendmsg+0x30/0x30 ? copymsghdr+0x410/0x410 ? _kasancheckread+0x11/0x20 ? marklock+0xe6/0x1470 _syssendmsg+0xe9/0x170 ? copymsghdrfromuser+0x120/0x120 ? _lockacquire+0xc62/0x1de0 ? dofaultaround+0x2c6/0x4e0 ? douseraddrfault+0x8c1/0xde0 ? reacquireheldlocks+0x220/0x4d0 ? douseraddrfault+0x8c1/0xde0 ? _kasancheckread+0x11/0x20 ? _fdget+0x4e/0x1d0 ? sockfdlookuplight+0x1a/0x170 _syssendmsg+0xd2/0x180 ? _syssendmsgsock+0x20/0x20 ? reacquireheldlocks+0x4d0/0x4d0 ? debugsmpprocessorid+0x17/0x20 _x64syssendmsg+0x72/0xb0 ? lockdephardirqson+0x7d/0x100 x64syscall+0x894/0x9f0 dosyscall64+0x64/0x130 entrySYSCALL64after ---truncated---

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.5-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}