| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-48826: drm/vc4: Fix deadlock on DSI device attach error |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/vc4: Fix deadlock on DSI device attach error |
| |
| DSI device attach to DSI host will be done with host device's lock |
| held. |
| |
| Un-registering host in "device attach" error path (ex: probe retry) |
| will result in deadlock with below call trace and non operational |
| DSI display. |
| |
| Startup Call trace: |
| [ 35.043036] rt_mutex_slowlock.constprop.21+0x184/0x1b8 |
| [ 35.043048] mutex_lock_nested+0x7c/0xc8 |
| [ 35.043060] device_del+0x4c/0x3e8 |
| [ 35.043075] device_unregister+0x20/0x40 |
| [ 35.043082] mipi_dsi_remove_device_fn+0x18/0x28 |
| [ 35.043093] device_for_each_child+0x68/0xb0 |
| [ 35.043105] mipi_dsi_host_unregister+0x40/0x90 |
| [ 35.043115] vc4_dsi_host_attach+0xf0/0x120 [vc4] |
| [ 35.043199] mipi_dsi_attach+0x30/0x48 |
| [ 35.043209] tc358762_probe+0x128/0x164 [tc358762] |
| [ 35.043225] mipi_dsi_drv_probe+0x28/0x38 |
| [ 35.043234] really_probe+0xc0/0x318 |
| [ 35.043244] __driver_probe_device+0x80/0xe8 |
| [ 35.043254] driver_probe_device+0xb8/0x118 |
| [ 35.043263] __device_attach_driver+0x98/0xe8 |
| [ 35.043273] bus_for_each_drv+0x84/0xd8 |
| [ 35.043281] __device_attach+0xf0/0x150 |
| [ 35.043290] device_initial_probe+0x1c/0x28 |
| [ 35.043300] bus_probe_device+0xa4/0xb0 |
| [ 35.043308] deferred_probe_work_func+0xa0/0xe0 |
| [ 35.043318] process_one_work+0x254/0x700 |
| [ 35.043330] worker_thread+0x4c/0x448 |
| [ 35.043339] kthread+0x19c/0x1a8 |
| [ 35.043348] ret_from_fork+0x10/0x20 |
| |
| Shutdown Call trace: |
| [ 365.565417] Call trace: |
| [ 365.565423] __switch_to+0x148/0x200 |
| [ 365.565452] __schedule+0x340/0x9c8 |
| [ 365.565467] schedule+0x48/0x110 |
| [ 365.565479] schedule_timeout+0x3b0/0x448 |
| [ 365.565496] wait_for_completion+0xac/0x138 |
| [ 365.565509] __flush_work+0x218/0x4e0 |
| [ 365.565523] flush_work+0x1c/0x28 |
| [ 365.565536] wait_for_device_probe+0x68/0x158 |
| [ 365.565550] device_shutdown+0x24/0x348 |
| [ 365.565561] kernel_restart_prepare+0x40/0x50 |
| [ 365.565578] kernel_restart+0x20/0x70 |
| [ 365.565591] __do_sys_reboot+0x10c/0x220 |
| [ 365.565605] __arm64_sys_reboot+0x2c/0x38 |
| [ 365.565619] invoke_syscall+0x4c/0x110 |
| [ 365.565634] el0_svc_common.constprop.3+0xfc/0x120 |
| [ 365.565648] do_el0_svc+0x2c/0x90 |
| [ 365.565661] el0_svc+0x4c/0xf0 |
| [ 365.565671] el0t_64_sync_handler+0x90/0xb8 |
| [ 365.565682] el0t_64_sync+0x180/0x184 |
| |
| The Linux kernel CVE team has assigned CVE-2022-48826 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 5.15.24 with commit 770d1ba9a8201ce9bee0946eb03746449b6f3b80 |
| Fixed in 5.16.10 with commit dddd832f35096fbc5004e3a7e58fb4d2cefb8deb |
| Fixed in 5.17 with commit 0a3d12ab5097b1d045e693412e6b366b7e82031b |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-48826 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/vc4/vc4_dsi.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/770d1ba9a8201ce9bee0946eb03746449b6f3b80 |
| https://git.kernel.org/stable/c/dddd832f35096fbc5004e3a7e58fb4d2cefb8deb |
| https://git.kernel.org/stable/c/0a3d12ab5097b1d045e693412e6b366b7e82031b |
