CVE-2024-57889

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking<br /> <br /> If a device uses MCP23xxx IO expander to receive IRQs, the following<br /> bug can happen:<br /> <br /> BUG: sleeping function called from invalid context<br /> at kernel/locking/mutex.c:283<br /> in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ...<br /> preempt_count: 1, expected: 0<br /> ...<br /> Call Trace:<br /> ...<br /> __might_resched+0x104/0x10e<br /> __might_sleep+0x3e/0x62<br /> mutex_lock+0x20/0x4c<br /> regmap_lock_mutex+0x10/0x18<br /> regmap_update_bits_base+0x2c/0x66<br /> mcp23s08_irq_set_type+0x1ae/0x1d6<br /> __irq_set_trigger+0x56/0x172<br /> __setup_irq+0x1e6/0x646<br /> request_threaded_irq+0xb6/0x160<br /> ...<br /> <br /> We observed the problem while experimenting with a touchscreen driver which<br /> used MCP23017 IO expander (I2C).<br /> <br /> The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from<br /> concurrent accesses, which is the default for regmaps without .fast_io,<br /> .disable_locking, etc.<br /> <br /> mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter<br /> locks the mutex.<br /> <br /> However, __setup_irq() locks desc-&gt;lock spinlock before calling these<br /> functions. As a result, the system tries to lock the mutex whole holding<br /> the spinlock.<br /> <br /> It seems, the internal regmap locks are not needed in this driver at all.<br /> mcp-&gt;lock seems to protect the regmap from concurrent accesses already,<br /> except, probably, in mcp_pinconf_get/set.<br /> <br /> mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under<br /> chip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes<br /> mcp-&gt;lock and enables regmap caching, so that the potentially slow I2C<br /> accesses are deferred until chip_bus_unlock().<br /> <br /> The accesses to the regmap from mcp23s08_probe_one() do not need additional<br /> locking.<br /> <br /> In all remaining places where the regmap is accessed, except<br /> mcp_pinconf_get/set(), the driver already takes mcp-&gt;lock.<br /> <br /> This patch adds locking in mcp_pinconf_get/set() and disables internal<br /> locking in the regmap config. Among other things, it fixes the sleeping<br /> in atomic context described above.