CVE: CVE-2024-46680
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btnxpuart: Fix random crash seen while removing driver

This fixes the random kernel crash seen while removing the driver, when
running the load/unload test over multiple iterations.

1) modprobe btnxpuart
2) hciconfig hci0 reset
3) hciconfig (check hci0 interface up with valid BD address)
4) modprobe -r btnxpuart
Repeat steps 1 to 4

The ps_wakeup() call in btnxpuart_close() schedules the psdata->work(),
which gets scheduled after module is removed, causing a kernel crash.

This hidden issue got highlighted after enabling Power Save by default
in 4183a7be7700 (Bluetooth: btnxpuart: Enable Power Save feature on
startup)

The new ps_cleanup() deasserts UART break immediately while closing
serdev device, cancels any scheduled ps_work and destroys the ps_lock
mutex.

[   85.884604] Unable to handle kernel paging request at virtual address ffffd4a61638f258
[   85.884624] Mem abort info:
[   85.884625]   ESR = 0x[PII_REDACTED]000007
[   85.884628]   EC = 0x21: IABT (current EL), IL = 32 bits
[   85.884633]   SET = 0, FnV = 0
[   85.884636]   EA = 0, S1PTW = 0
[   85.884638]   FSC = 0x07: level 3 translation fault
[   85.884642] swapper pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]dd0000
[   85.884646] [ffffd4a61638f258] pgd=[PII_REDACTED]fff003, p4d=[PII_REDACTED]fff003, pud=[PII_REDACTED]3d003, pmd=[PII_REDACTED]3e003, pte=[PII_REDACTED]
[   85.884662] Internal error: Oops: [PII_REDACTED] [#1] PREEMPT SMP
[   85.890932] Modules linked in: algif_hash algif_skcipher af_alg overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_spdif snd_soc_fsl_micfil snd_soc_fsl_sai snd_soc_fsl_utils gpio_ir_recv rc_core fuse [last unloaded: btnxpuart(O)]
[   85.927297] CPU: 1 PID: 67 Comm: kworker/1:3 Tainted: G           O       6.1.36+g937b1be4345a #1
[   85.936176] Hardware name: FSL i.MX8MM EVK board (DT)
[   85.936182] Workqueue: events 0xffffd4a61638f380
[   85.936198] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   85.952817] pc : 0xffffd4a61638f258
[   85.952823] lr : 0xffffd4a61638f258
[   85.952827] sp : ffff8000084fbd70
[   85.952829] x29: ffff8000084fbd70 x28: [PII_REDACTED] x27: [PII_REDACTED]
[   85.963112] x26: ffffd4a69133f000 x25: ffff4bf1c8540990 x24: ffff4bf215b87305
[   85.963119] x23: ffff4bf215b87300 x22: ffff4bf1c85409d0 x21: ffff4bf1c8540970
[   85.977382] x20: [PII_REDACTED] x19: ffff4bf1c8540880 x18: [PII_REDACTED]
[   85.977391] x17: [PII_REDACTED] x16: [PII_REDACTED] x15: 0000ffffe2217090
[   85.977399] x14: [PII_REDACTED] x13: [PII_REDACTED] x12: [PII_REDACTED]
[   85.977407] x11: [PII_REDACTED] x10:[PII_REDACTED]000a60 x9 : ffff8000084fbc50
[   85.977417] x8 : ffff4bf215b7d000 x7 : ffff4bf215b83b40 x6 :[PII_REDACTED]0003e8
[   85.977424] x5 :[PII_REDACTED]0fd030 x4 : [PII_REDACTED] x3 : [PII_REDACTED]
[   85.977432] x2 : [PII_REDACTED] x1 : ffff4bf1c4265880 x0 : [PII_REDACTED]
[   85.977443] Call trace:
[   85.977446]  0xffffd4a61638f258
[   85.977451]  0xffffd4a61638f3e8
[   85.977455]  process_one_work+0x1d4/0x330
[   85.977464]  worker_thread+0x6c/0x430
[   85.977471]  kthread+0x108/0x10c
[   85.977476]  ret_from_fork+0x10/0x20
[   85.977488] Code: bad PC value
[   85.977491] ---[ end trace [PII_REDACTED] ]---

Preset since v6.9.11
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/29a1d9971e38f92c84b363ff50379dd434ddfe1c; https://git.kernel.org/stable/c/[PII_REDACTED]4ab3622f63c3c09bdf6af6dacfe9c3; https://git.kernel.org/stable/c/662a55986b88807da4d112d838c8aaa05810e938