| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-21684: gpio: xilinx: Convert gpio_lock to raw spinlock |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| gpio: xilinx: Convert gpio_lock to raw spinlock |
| |
| irq_chip functions may be called in raw spinlock context. Therefore, we |
| must also use a raw spinlock for our own internal locking. |
| |
| This fixes the following lockdep splat: |
| |
| [ 5.349336] ============================= |
| [ 5.353349] [ BUG: Invalid wait context ] |
| [ 5.357361] 6.13.0-rc5+ #69 Tainted: G W |
| [ 5.363031] ----------------------------- |
| [ 5.367045] kworker/u17:1/44 is trying to lock: |
| [ 5.371587] ffffff88018b02c0 (&chip->gpio_lock){....}-{3:3}, at: xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8)) |
| [ 5.380079] other info that might help us debug this: |
| [ 5.385138] context-{5:5} |
| [ 5.387762] 5 locks held by kworker/u17:1/44: |
| [ 5.392123] #0: ffffff8800014958 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3204) |
| [ 5.402260] #1: ffffffc082fcbdd8 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3205) |
| [ 5.411528] #2: ffffff880172c900 (&dev->mutex){....}-{4:4}, at: __device_attach (drivers/base/dd.c:1006) |
| [ 5.419929] #3: ffffff88039c8268 (request_class#2){+.+.}-{4:4}, at: __setup_irq (kernel/irq/internals.h:156 kernel/irq/manage.c:1596) |
| [ 5.428331] #4: ffffff88039c80c8 (lock_class#2){....}-{2:2}, at: __setup_irq (kernel/irq/manage.c:1614) |
| [ 5.436472] stack backtrace: |
| [ 5.439359] CPU: 2 UID: 0 PID: 44 Comm: kworker/u17:1 Tainted: G W 6.13.0-rc5+ #69 |
| [ 5.448690] Tainted: [W]=WARN |
| [ 5.451656] Hardware name: xlnx,zynqmp (DT) |
| [ 5.455845] Workqueue: events_unbound deferred_probe_work_func |
| [ 5.461699] Call trace: |
| [ 5.464147] show_stack+0x18/0x24 C |
| [ 5.467821] dump_stack_lvl (lib/dump_stack.c:123) |
| [ 5.471501] dump_stack (lib/dump_stack.c:130) |
| [ 5.474824] __lock_acquire (kernel/locking/lockdep.c:4828 kernel/locking/lockdep.c:4898 kernel/locking/lockdep.c:5176) |
| [ 5.478758] lock_acquire (arch/arm64/include/asm/percpu.h:40 kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851 kernel/locking/lockdep.c:5814) |
| [ 5.482429] _raw_spin_lock_irqsave (include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) |
| [ 5.486797] xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8)) |
| [ 5.490737] irq_enable (kernel/irq/internals.h:236 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345) |
| [ 5.494060] __irq_startup (kernel/irq/internals.h:241 kernel/irq/chip.c:180 kernel/irq/chip.c:250) |
| [ 5.497645] irq_startup (kernel/irq/chip.c:270) |
| [ 5.501143] __setup_irq (kernel/irq/manage.c:1807) |
| [ 5.504728] request_threaded_irq (kernel/irq/manage.c:2208) |
| |
| The Linux kernel CVE team has assigned CVE-2025-21684 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.12 with commit a32c7caea292c4d1e417eae6e5a348d187546acf and fixed in 5.15.179 with commit d25041d4a3b2af64c888cf762362b2528ba59294 |
| Issue introduced in 5.12 with commit a32c7caea292c4d1e417eae6e5a348d187546acf and fixed in 6.1.129 with commit f0ed2d0abc021f56fa27dc6d0770535c1851a43b |
| Issue introduced in 5.12 with commit a32c7caea292c4d1e417eae6e5a348d187546acf and fixed in 6.6.74 with commit b0111650ee596219bb5defa0ce1a1308e6e77ccf |
| Issue introduced in 5.12 with commit a32c7caea292c4d1e417eae6e5a348d187546acf and fixed in 6.12.11 with commit 9c035105c5537d2ecad6b9415e9417a1ffbd0a62 |
| Issue introduced in 5.12 with commit a32c7caea292c4d1e417eae6e5a348d187546acf and fixed in 6.13 with commit 9860370c2172704b6b4f0075a0c2a29fd84af96a |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-21684 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpio/gpio-xilinx.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d25041d4a3b2af64c888cf762362b2528ba59294 |
| https://git.kernel.org/stable/c/f0ed2d0abc021f56fa27dc6d0770535c1851a43b |
| https://git.kernel.org/stable/c/b0111650ee596219bb5defa0ce1a1308e6e77ccf |
| https://git.kernel.org/stable/c/9c035105c5537d2ecad6b9415e9417a1ffbd0a62 |
| https://git.kernel.org/stable/c/9860370c2172704b6b4f0075a0c2a29fd84af96a |
