| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-53094: tty: serial: fsl_lpuart: fix race on RX DMA shutdown |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| tty: serial: fsl_lpuart: fix race on RX DMA shutdown |
| |
| From time to time DMA completion can come in the middle of DMA shutdown: |
| |
| <process ctx>: <IRQ>: |
| lpuart32_shutdown() |
| lpuart_dma_shutdown() |
| del_timer_sync() |
| lpuart_dma_rx_complete() |
| lpuart_copy_rx_to_tty() |
| mod_timer() |
| lpuart_dma_rx_free() |
| |
| When the timer fires a bit later, sport->dma_rx_desc is NULL: |
| |
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 |
| pc : lpuart_copy_rx_to_tty+0xcc/0x5bc |
| lr : lpuart_timer_func+0x1c/0x2c |
| Call trace: |
| lpuart_copy_rx_to_tty |
| lpuart_timer_func |
| call_timer_fn |
| __run_timers.part.0 |
| run_timer_softirq |
| __do_softirq |
| __irq_exit_rcu |
| irq_exit |
| handle_domain_irq |
| gic_handle_irq |
| call_on_irq_stack |
| do_interrupt_handler |
| ... |
| |
| To fix this fold del_timer_sync() into lpuart_dma_rx_free() after |
| dmaengine_terminate_sync() to make sure timer will not be re-started in |
| lpuart_copy_rx_to_tty() <= lpuart_dma_rx_complete(). |
| |
| The Linux kernel CVE team has assigned CVE-2023-53094 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.0 with commit 4a8588a1cf867333187d9ff071e6fbdab587d194 and fixed in 5.10.177 with commit 19a98d56dfedafb25652bdb9cd48a4e73ceba702 |
| Issue introduced in 4.0 with commit 4a8588a1cf867333187d9ff071e6fbdab587d194 and fixed in 5.15.105 with commit 90530e7214c8a04dcdde57502d93fa96af288c38 |
| Issue introduced in 4.0 with commit 4a8588a1cf867333187d9ff071e6fbdab587d194 and fixed in 6.1.23 with commit 954fc9931f0aabf272b5674cf468affdd88d3a36 |
| Issue introduced in 4.0 with commit 4a8588a1cf867333187d9ff071e6fbdab587d194 and fixed in 6.2.8 with commit 2a36b444cace9580380467fd1183bb5e85bcc80a |
| Issue introduced in 4.0 with commit 4a8588a1cf867333187d9ff071e6fbdab587d194 and fixed in 6.3 with commit 1be6f2b15f902c02e055ae0b419ca789200473c9 |
| Issue introduced in 3.18.9 with commit 5716a781032693d0f812ed06528d98195e9df028 |
| Issue introduced in 3.19.1 with commit 0d5cb6e8b4b62d8efd1a470615894276341d6db9 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-53094 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/tty/serial/fsl_lpuart.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/19a98d56dfedafb25652bdb9cd48a4e73ceba702 |
| https://git.kernel.org/stable/c/90530e7214c8a04dcdde57502d93fa96af288c38 |
| https://git.kernel.org/stable/c/954fc9931f0aabf272b5674cf468affdd88d3a36 |
| https://git.kernel.org/stable/c/2a36b444cace9580380467fd1183bb5e85bcc80a |
| https://git.kernel.org/stable/c/1be6f2b15f902c02e055ae0b419ca789200473c9 |
