CVE-2024-57991

wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()

Medium · published February 27, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()

During rtw89_entity_recalc_mgnt_roles(), there is a normalizing process

which will re-order the list if an entry with target pattern is found.

And once one is found, should have aborted the list_for_each_entry. But,

`break` just aborted the inner for-loop. The outer list_for_each_entry

still continues. Normally, only the first entry will match the target

pattern, and the re-ordering will change nothing, so there won't be

soft lockup. However, in some special cases, soft lockup would happen.

Fix it by `goto fill` to break from the list_for_each_entry.

The following is a sample of kernel log for this problem.

watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [wpa_supplicant:2055]

[...]

RIP: 0010:rtw89_entity_recalc ([...] chan.c:392 chan.c:479) rtw89_core

[...]

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Published
2025-02-27T02:07Z
EPSS history
Timeline
  • 27 FEB 02:07Z
    wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()
    cvelistv5