Deadlock in Linux Kernel mt76 WiFi Driver

Executive Summary

This vulnerability is a deadlock issue in the Linux kernel's mt76 wifi driver. Specifically, the functions mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel() while already holding a mutex (dev->mutex). Since mt76_set_channel() also tries to acquire the same mutex, this causes a deadlock.

The fix involves using an internal function __mt76_set_channel() instead of mt76_set_channel() to avoid re-acquiring the mutex, and adding cancel_delayed_work_sync() for mac_work before acquiring the mutex in mt76_remain_on_channel() to prevent a secondary deadlock with the mac_work workqueue.

Useful 0 Not Useful 0

Impact Analysis

This deadlock vulnerability can cause the affected wifi driver to hang or freeze when handling remain-on-channel operations. This can lead to loss of wifi connectivity or degraded network performance on systems using the mt76 driver, potentially disrupting network-dependent applications or services.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by modifying the Linux kernel code to avoid deadlocks in the mt76 wifi driver. Specifically, the fix involves using __mt76_set_channel() instead of mt76_set_channel() and adding cancel_delayed_work_sync() for mac_work before acquiring the mutex in mt76_remain_on_channel().

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0