wifi: ath10k: Delay the unmapping of the buffer
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has sent, this is leading into an SMMU fault triggering kernel panic. This is happening on copy engine channel 3 (CE3) where the driver normally enqueues WMI commands to the firmware. Upon receiving a copy complete interrupt, host driver will immediately unmap and frees the buffer presuming that hardware has processed the buffer. In the issue case, upon receiving copy complete interrupt, host driver will unmap and free the buffer but since hardware is still accessing the buffer (which in this case got unmapped in parallel), SMMU hardware will trigger an SMMU fault resulting in a kernel panic. In order to avoid this, as a work around, add a delay before unmapping the copy engine source DMA buffer. This is conditionally done for WCN3990 and only for the CE3 channel where issue is seen. Below is the crash signature: wifi smmu error: kernel: [ 10.120965] arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x7fdfd8ac0, fsynr=0x500003,cbfrsynra=0xc1, cb=6 arm-smmu 15000000.iommu: Unhandled context fault:fsr=0x402, iova=0x7fe06fdc0, fsynr=0x710003, cbfrsynra=0xc1, cb=6 qcom-q6v5-mss 4080000.remoteproc: fatal error received: err_qdi.c:1040:EF:wlan_process:0x1:WLAN RT:0x2091: cmnos_thr
CVE-2022-50700
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2022-50700
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d390509bdf501c9c8c6e61248e4bc9314c86d854",
"lessThan": "c4bedc3cda09d896c92adcdb6b62aa93b0c47a8a",
"versionType": "git"
},
{
"status": "affected",
"version": "d390509bdf501c9c8c6e61248e4bc9314c86d854",
"lessThan": "79a124b588aadb5a22695542778de14366ff3219",
"versionType": "git"
},
{
"status": "affected",
"version": "d390509bdf501c9c8c6e61248e4bc9314c86d854",
"lessThan": "acd4324e5f1f11351630234297f95076f0ac9a2f",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/wireless/ath/ath10k/core.c",
"drivers/net/wireless/ath/ath10k/htc.c",
"drivers/net/wireless/ath/ath10k/hw.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver",
"lessThanOrEqual": "6.0.*"
},
{
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/ath/ath10k/core.c",
"drivers/net/wireless/ath/ath10k/htc.c",
"drivers/net/wireless/ath/ath10k/hw.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2022-50700
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30229 · Revision 1
- Added to Heist Feed
- Publisher date