CVE-2024-57889
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
15/01/2025
Last modified:
15/01/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking<br />
<br />
If a device uses MCP23xxx IO expander to receive IRQs, the following<br />
bug can happen:<br />
<br />
BUG: sleeping function called from invalid context<br />
at kernel/locking/mutex.c:283<br />
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ...<br />
preempt_count: 1, expected: 0<br />
...<br />
Call Trace:<br />
...<br />
__might_resched+0x104/0x10e<br />
__might_sleep+0x3e/0x62<br />
mutex_lock+0x20/0x4c<br />
regmap_lock_mutex+0x10/0x18<br />
regmap_update_bits_base+0x2c/0x66<br />
mcp23s08_irq_set_type+0x1ae/0x1d6<br />
__irq_set_trigger+0x56/0x172<br />
__setup_irq+0x1e6/0x646<br />
request_threaded_irq+0xb6/0x160<br />
...<br />
<br />
We observed the problem while experimenting with a touchscreen driver which<br />
used MCP23017 IO expander (I2C).<br />
<br />
The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from<br />
concurrent accesses, which is the default for regmaps without .fast_io,<br />
.disable_locking, etc.<br />
<br />
mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter<br />
locks the mutex.<br />
<br />
However, __setup_irq() locks desc->lock spinlock before calling these<br />
functions. As a result, the system tries to lock the mutex whole holding<br />
the spinlock.<br />
<br />
It seems, the internal regmap locks are not needed in this driver at all.<br />
mcp->lock seems to protect the regmap from concurrent accesses already,<br />
except, probably, in mcp_pinconf_get/set.<br />
<br />
mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under<br />
chip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes<br />
mcp->lock and enables regmap caching, so that the potentially slow I2C<br />
accesses are deferred until chip_bus_unlock().<br />
<br />
The accesses to the regmap from mcp23s08_probe_one() do not need additional<br />
locking.<br />
<br />
In all remaining places where the regmap is accessed, except<br />
mcp_pinconf_get/set(), the driver already takes mcp->lock.<br />
<br />
This patch adds locking in mcp_pinconf_get/set() and disables internal<br />
locking in the regmap config. Among other things, it fixes the sleeping<br />
in atomic context described above.
Impact
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/0310cbad163a908d09d99c26827859365cd71fcb
- https://git.kernel.org/stable/c/788d9e9a41b81893d6bb8faa05f045c975278318
- https://git.kernel.org/stable/c/830f838589522404cd7c2f0f540602f25034af61
- https://git.kernel.org/stable/c/8c6fd5803b988a5e78c9b9e42c70a936d7cfc6ec
- https://git.kernel.org/stable/c/9372e160d8211a7e17f2abff8370794f182df785
- https://git.kernel.org/stable/c/a37eecb705f33726f1fb7cd2a67e514a15dfe693
- https://git.kernel.org/stable/c/c55d186376a87b468c9ee30f2195e0f3857f61a0