CVE-2022-49441 (GCVE-0-2022-49441)
Vulnerability from cvelistv5
Published
2025-02-26 02:12
Modified
2025-05-04 12:44
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: tty: fix deadlock caused by calling printk() under tty_port->lock pty_write() invokes kmalloc() which may invoke a normal printk() to print failure message. This can cause a deadlock in the scenario reported by syz-bot below: CPU0 CPU1 CPU2 ---- ---- ---- lock(console_owner); lock(&port_lock_key); lock(&port->lock); lock(&port_lock_key); lock(&port->lock); lock(console_owner); As commit dbdda842fe96 ("printk: Add console owner and waiter logic to load balance console writes") said, such deadlock can be prevented by using printk_deferred() in kmalloc() (which is invoked in the section guarded by the port->lock). But there are too many printk() on the kmalloc() path, and kmalloc() can be called from anywhere, so changing printk() to printk_deferred() is too complicated and inelegant. Therefore, this patch chooses to specify __GFP_NOWARN to kmalloc(), so that printk() will not be called, and this deadlock problem can be avoided. Syzbot reported the following lockdep error: ====================================================== WARNING: possible circular locking dependency detected 5.4.143-00237-g08ccc19a-dirty #10 Not tainted ------------------------------------------------------ syz-executor.4/29420 is trying to acquire lock: ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline] ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023 but task is already holding lock: ffff8880119c9158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&port->lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 tty_port_tty_get drivers/tty/tty_port.c:288 [inline] <-- lock(&port->lock); tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47 serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] <-- lock(&port_lock_key); serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156 [...] -> #1 (&port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198 <-- lock(&port_lock_key); call_console_drivers kernel/printk/printk.c:1819 [inline] console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504 vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024 <-- lock(console_owner); vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 register_console+0x8b3/0xc10 kernel/printk/printk.c:2829 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681 console_init+0x49d/0x6d3 kernel/printk/printk.c:2915 start_kernel+0x5e9/0x879 init/main.c:713 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 -> #0 (console_owner){....}-{0:0}: [...] lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734 console_trylock_spinning kernel/printk/printk.c:1773 ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/04ee31678c128a6cc7bb057ea189a8624ba5a314Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0bcf44903ef4df742dcada86ccaedd25374ffb50Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/18ca0d55e8639b911df8aae1b47598b13f9acdedPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3219ac364ac3d8d30771612a6010f1e0b7fa0a28Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4af21b12a60ed2d3642284f4f85b42d7dc6ac246Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4c253caf9264d2aa47ee806a87986dd8eb91a5d9Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6b9dbedbe3499fef862c4dff5217cf91f34e43b3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9834b13e8b962caa28fbcf1f422dd82413da4edePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b3c974501d0c32258ae0e04e5cc3fb92383b40f6Patch
Impacted products
Vendor Product Version
Linux Linux Version: d83904cb2eb2c4d937eaf15032214b0578f25099
Version: deb1feaad03a78b545c949e54582ae57b3c56982
Version: b6da31b2c07c46f2dcad1d86caa835227a16d9ff
Version: b6da31b2c07c46f2dcad1d86caa835227a16d9ff
Version: b6da31b2c07c46f2dcad1d86caa835227a16d9ff
Version: b6da31b2c07c46f2dcad1d86caa835227a16d9ff
Version: b6da31b2c07c46f2dcad1d86caa835227a16d9ff
Version: b6da31b2c07c46f2dcad1d86caa835227a16d9ff
Version: b6da31b2c07c46f2dcad1d86caa835227a16d9ff
Version: 6d9cd12792270773fab9e5a129daff328d61ef9e
Version: 6dbfa9b5ae65063cd61dc7fa11332e00bb794d8b
Version: 60c4e8db32815474bfaeabe888ebb14e698caea1
 Create a notification for this product.
   Linux Linux Version: 4.18
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/tty_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4af21b12a60ed2d3642284f4f85b42d7dc6ac246",
              "status": "affected",
              "version": "d83904cb2eb2c4d937eaf15032214b0578f25099",
              "versionType": "git"
            },
            {
              "lessThan": "4c253caf9264d2aa47ee806a87986dd8eb91a5d9",
              "status": "affected",
              "version": "deb1feaad03a78b545c949e54582ae57b3c56982",
              "versionType": "git"
            },
            {
              "lessThan": "04ee31678c128a6cc7bb057ea189a8624ba5a314",
              "status": "affected",
              "version": "b6da31b2c07c46f2dcad1d86caa835227a16d9ff",
              "versionType": "git"
            },
            {
              "lessThan": "3219ac364ac3d8d30771612a6010f1e0b7fa0a28",
              "status": "affected",
              "version": "b6da31b2c07c46f2dcad1d86caa835227a16d9ff",
              "versionType": "git"
            },
            {
              "lessThan": "9834b13e8b962caa28fbcf1f422dd82413da4ede",
              "status": "affected",
              "version": "b6da31b2c07c46f2dcad1d86caa835227a16d9ff",
              "versionType": "git"
            },
            {
              "lessThan": "18ca0d55e8639b911df8aae1b47598b13f9acded",
              "status": "affected",
              "version": "b6da31b2c07c46f2dcad1d86caa835227a16d9ff",
              "versionType": "git"
            },
            {
              "lessThan": "b3c974501d0c32258ae0e04e5cc3fb92383b40f6",
              "status": "affected",
              "version": "b6da31b2c07c46f2dcad1d86caa835227a16d9ff",
              "versionType": "git"
            },
            {
              "lessThan": "0bcf44903ef4df742dcada86ccaedd25374ffb50",
              "status": "affected",
              "version": "b6da31b2c07c46f2dcad1d86caa835227a16d9ff",
              "versionType": "git"
            },
            {
              "lessThan": "6b9dbedbe3499fef862c4dff5217cf91f34e43b3",
              "status": "affected",
              "version": "b6da31b2c07c46f2dcad1d86caa835227a16d9ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6d9cd12792270773fab9e5a129daff328d61ef9e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6dbfa9b5ae65063cd61dc7fa11332e00bb794d8b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60c4e8db32815474bfaeabe888ebb14e698caea1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/tty_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.318",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.318",
                  "versionStartIncluding": "4.9.117",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.283",
                  "versionStartIncluding": "4.14.60",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.146",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.17.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: fix deadlock caused by calling printk() under tty_port-\u003elock\n\npty_write() invokes kmalloc() which may invoke a normal printk() to print\nfailure message.  This can cause a deadlock in the scenario reported by\nsyz-bot below:\n\n       CPU0              CPU1                    CPU2\n       ----              ----                    ----\n                         lock(console_owner);\n                                                 lock(\u0026port_lock_key);\n  lock(\u0026port-\u003elock);\n                         lock(\u0026port_lock_key);\n                                                 lock(\u0026port-\u003elock);\n  lock(console_owner);\n\nAs commit dbdda842fe96 (\"printk: Add console owner and waiter logic to\nload balance console writes\") said, such deadlock can be prevented by\nusing printk_deferred() in kmalloc() (which is invoked in the section\nguarded by the port-\u003elock).  But there are too many printk() on the\nkmalloc() path, and kmalloc() can be called from anywhere, so changing\nprintk() to printk_deferred() is too complicated and inelegant.\n\nTherefore, this patch chooses to specify __GFP_NOWARN to kmalloc(), so\nthat printk() will not be called, and this deadlock problem can be\navoided.\n\nSyzbot reported the following lockdep error:\n\n======================================================\nWARNING: possible circular locking dependency detected\n5.4.143-00237-g08ccc19a-dirty #10 Not tainted\n------------------------------------------------------\nsyz-executor.4/29420 is trying to acquire lock:\nffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline]\nffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023\n\nbut task is already holding lock:\nffff8880119c9158 (\u0026port-\u003elock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #2 (\u0026port-\u003elock){-.-.}-{2:2}:\n       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n       _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159\n       tty_port_tty_get drivers/tty/tty_port.c:288 [inline]          \t\t\u003c-- lock(\u0026port-\u003elock);\n       tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47\n       serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767\n       serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854\n       serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] \t\u003c-- lock(\u0026port_lock_key);\n       serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870\n       serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126\n       __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156\n       [...]\n\n-\u003e #1 (\u0026port_lock_key){-.-.}-{2:2}:\n       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n       _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159\n       serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198\n\t\t\t\t\t\t\t\t\t\t\u003c-- lock(\u0026port_lock_key);\n       call_console_drivers kernel/printk/printk.c:1819 [inline]\n       console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504\n       vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024\t\t\t\u003c-- lock(console_owner);\n       vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394\n       printk+0xba/0xed kernel/printk/printk.c:2084\n       register_console+0x8b3/0xc10 kernel/printk/printk.c:2829\n       univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681\n       console_init+0x49d/0x6d3 kernel/printk/printk.c:2915\n       start_kernel+0x5e9/0x879 init/main.c:713\n       secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241\n\n-\u003e #0 (console_owner){....}-{0:0}:\n       [...]\n       lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734\n       console_trylock_spinning kernel/printk/printk.c:1773 \n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:44:42.797Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4af21b12a60ed2d3642284f4f85b42d7dc6ac246"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c253caf9264d2aa47ee806a87986dd8eb91a5d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/04ee31678c128a6cc7bb057ea189a8624ba5a314"
        },
        {
          "url": "https://git.kernel.org/stable/c/3219ac364ac3d8d30771612a6010f1e0b7fa0a28"
        },
        {
          "url": "https://git.kernel.org/stable/c/9834b13e8b962caa28fbcf1f422dd82413da4ede"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ca0d55e8639b911df8aae1b47598b13f9acded"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3c974501d0c32258ae0e04e5cc3fb92383b40f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bcf44903ef4df742dcada86ccaedd25374ffb50"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b9dbedbe3499fef862c4dff5217cf91f34e43b3"
        }
      ],
      "title": "tty: fix deadlock caused by calling printk() under tty_port-\u003elock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49441",
    "datePublished": "2025-02-26T02:12:54.649Z",
    "dateReserved": "2025-02-26T02:08:31.570Z",
    "dateUpdated": "2025-05-04T12:44:42.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49441\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:20.523\",\"lastModified\":\"2025-03-17T16:53:58.013\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: fix deadlock caused by calling printk() under tty_port-\u003elock\\n\\npty_write() invokes kmalloc() which may invoke a normal printk() to print\\nfailure message.  This can cause a deadlock in the scenario reported by\\nsyz-bot below:\\n\\n       CPU0              CPU1                    CPU2\\n       ----              ----                    ----\\n                         lock(console_owner);\\n                                                 lock(\u0026port_lock_key);\\n  lock(\u0026port-\u003elock);\\n                         lock(\u0026port_lock_key);\\n                                                 lock(\u0026port-\u003elock);\\n  lock(console_owner);\\n\\nAs commit dbdda842fe96 (\\\"printk: Add console owner and waiter logic to\\nload balance console writes\\\") said, such deadlock can be prevented by\\nusing printk_deferred() in kmalloc() (which is invoked in the section\\nguarded by the port-\u003elock).  But there are too many printk() on the\\nkmalloc() path, and kmalloc() can be called from anywhere, so changing\\nprintk() to printk_deferred() is too complicated and inelegant.\\n\\nTherefore, this patch chooses to specify __GFP_NOWARN to kmalloc(), so\\nthat printk() will not be called, and this deadlock problem can be\\navoided.\\n\\nSyzbot reported the following lockdep error:\\n\\n======================================================\\nWARNING: possible circular locking dependency detected\\n5.4.143-00237-g08ccc19a-dirty #10 Not tainted\\n------------------------------------------------------\\nsyz-executor.4/29420 is trying to acquire lock:\\nffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline]\\nffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023\\n\\nbut task is already holding lock:\\nffff8880119c9158 (\u0026port-\u003elock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120\\n\\nwhich lock already depends on the new lock.\\n\\nthe existing dependency chain (in reverse order) is:\\n\\n-\u003e #2 (\u0026port-\u003elock){-.-.}-{2:2}:\\n       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\\n       _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159\\n       tty_port_tty_get drivers/tty/tty_port.c:288 [inline]          \\t\\t\u003c-- lock(\u0026port-\u003elock);\\n       tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47\\n       serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767\\n       serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854\\n       serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] \\t\u003c-- lock(\u0026port_lock_key);\\n       serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870\\n       serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126\\n       __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156\\n       [...]\\n\\n-\u003e #1 (\u0026port_lock_key){-.-.}-{2:2}:\\n       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\\n       _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159\\n       serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198\\n\\t\\t\\t\\t\\t\\t\\t\\t\\t\\t\u003c-- lock(\u0026port_lock_key);\\n       call_console_drivers kernel/printk/printk.c:1819 [inline]\\n       console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504\\n       vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024\\t\\t\\t\u003c-- lock(console_owner);\\n       vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394\\n       printk+0xba/0xed kernel/printk/printk.c:2084\\n       register_console+0x8b3/0xc10 kernel/printk/printk.c:2829\\n       univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681\\n       console_init+0x49d/0x6d3 kernel/printk/printk.c:2915\\n       start_kernel+0x5e9/0x879 init/main.c:713\\n       secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241\\n\\n-\u003e #0 (console_owner){....}-{0:0}:\\n       [...]\\n       lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734\\n       console_trylock_spinning kernel/printk/printk.c:1773 \\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: se corrige el bloqueo causado por llamar a printk() bajo tty_port-\u0026gt;lock pty_write() invoca kmalloc() que puede invocar un printk() normal para imprimir un mensaje de error. Esto puede causar un bloqueo en el escenario informado por syz-bot a continuaci\u00f3n: CPU0 CPU1 CPU2 ---- ---- ---- lock(console_owner); lock(\u0026amp;port_lock_key); lock(\u0026amp;port-\u0026gt;lock); lock(\u0026amp;port_lock_key); lock(\u0026amp;port-\u0026gt;lock); lock(console_owner); Como dijo el commit dbdda842fe96 (\\\"printk: Agregar l\u00f3gica de propietario y espera de consola para equilibrar la carga de escrituras de consola\\\"), dicho bloqueo se puede prevenir usando printk_deferred() en kmalloc() (que se invoca en la secci\u00f3n protegida por port-\u0026gt;lock). Pero hay demasiados printk() en la ruta kmalloc() y kmalloc() se puede llamar desde cualquier lugar, por lo que cambiar printk() a printk_deferred() es demasiado complicado y poco elegante. Por lo tanto, este parche elige especificar __GFP_NOWARN en kmalloc(), de modo que no se llame a printk() y se pueda evitar este problema de bloqueo. Syzbot inform\u00f3 el siguiente error de lockdep: ======================================================== ADVERTENCIA: posible dependencia de bloqueo circular detectada 5.4.143-00237-g08ccc19a-dirty #10 Not tainted ------------------------------------------------------ syz-executor.4/29420 is trying to acquire lock: ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline] ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023 but task is already holding lock: ffff8880119c9158 (\u0026amp;port-\u0026gt;lock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -\u0026gt; #2 (\u0026amp;port-\u0026gt;lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 tty_port_tty_get drivers/tty/tty_port.c:288 [inline] \u0026lt;-- lock(\u0026amp;port-\u0026gt;lock); tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47 serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] \u0026lt;-- lock(\u0026amp;port_lock_key); serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156 [...] -\u0026gt; #1 (\u0026amp;port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198 \u0026lt;-- lock(\u0026amp;port_lock_key); call_console_drivers kernel/printk/printk.c:1819 [inline] console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504 vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024 \u0026lt;-- lock(console_owner); vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 register_console+0x8b3/0xc10 kernel/printk/printk.c:2829 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681 console_init+0x49d/0x6d3 kernel/printk/printk.c:2915 start_kernel+0x5e9/0x879 init/main.c:713 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 -\u0026gt; #0 (console_owner){....}-{0:0}: [...] lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734 console_trylock_spinning kernel/printk/printk.c:1773 ---truncated--- \"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.18.118\",\"versionEndExcluding\":\"3.19\",\"matchCriteriaId\":\"3E38B3B3-C9B4-4F8E-B27F-E121FA35D422\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.146\",\"versionEndExcluding\":\"4.5\",\"matchCriteriaId\":\"9F7ABD11-7E25-4617-AD4B-2068A90C7EF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.117\",\"versionEndExcluding\":\"4.9.318\",\"matchCriteriaId\":\"FF4DA68C-0A82-4061-AEA7-59632762D9E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.60\",\"versionEndExcluding\":\"4.14.283\",\"matchCriteriaId\":\"378D8F4C-4F16-4488-9872-625DEA9B337A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17.12\",\"versionEndExcluding\":\"4.19.247\",\"matchCriteriaId\":\"A0236C89-21F4-4889-AA04-D7985FBBD23F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.198\",\"matchCriteriaId\":\"3EC49633-14DE-4EBD-BB80-76AE2E3EABB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.121\",\"matchCriteriaId\":\"34ACD872-E5BC-401C-93D5-B357A62426E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.46\",\"matchCriteriaId\":\"20D41697-0E8B-4B7D-8842-F17BF2AA21E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"15E2DD33-2255-4B76-9C15-04FF8CBAB252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04ee31678c128a6cc7bb057ea189a8624ba5a314\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0bcf44903ef4df742dcada86ccaedd25374ffb50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/18ca0d55e8639b911df8aae1b47598b13f9acded\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3219ac364ac3d8d30771612a6010f1e0b7fa0a28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4af21b12a60ed2d3642284f4f85b42d7dc6ac246\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c253caf9264d2aa47ee806a87986dd8eb91a5d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b9dbedbe3499fef862c4dff5217cf91f34e43b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9834b13e8b962caa28fbcf1f422dd82413da4ede\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3c974501d0c32258ae0e04e5cc3fb92383b40f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.