In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump<\/p>\n
On WCN3990\/SNOC the MSA region is mapped with devm_memremap(MEMREMAP_WT).
\nOn arm64 such a mapping is not Normal-cacheable, so unaligned accesses to
\nit are not permitted. ath10k_msa_dump_memory() copies the region with a
\nplain memcpy(), whose optimized __pi_memcpy_generic implementation issues
\nwide\/unaligned loads. This triggers an alignment fault (FSC=0x21) Oops in
\nath10k_snoc_fw_crashed_dump() while collecting the devcoredump:<\/p>\n
Unable to handle kernel paging request … FSC=0x21: alignment fault
\n pc : __pi_memcpy_generic
\n lr : ath10k_snoc_fw_crashed_dump [ath10k_snoc]<\/p>\n
The Oops both leaves the firmware RAM dump buffer zeroed (no dump is
\ncaptured) and crashes the kernel, which in turn breaks modem SSR
\nrecovery.<\/p>\n
Use memcpy_fromio(), which only performs accesses that are valid for such
\na device-memory mapping. The generic memcpy_fromio() implementation aligns
\nthe source before issuing word-sized reads and stores the destination with
\nput_unaligned(), so it is also safe for the coherent DMA allocation used on
\nthe non-reserved-memory path. ath11k and ath12k use the same pattern
\nwhen copying target memory into crash dumps, so call it unconditionally
\nhere too.
\nThe MEMREMAP_WT pointer is a plain void *, so an explicit __iomem cast is
\nneeded; use __force to keep sparse happy.<\/p>\n
Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.3.7.c5-00107-QCAHLSWMTPL-1<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump<\/p>\n
On WCN3990\/SNOC the MSA region is mapped with devm_memremap(MEMREMAP_WT).<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25757","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}