{
  "affected": [],
  "aliases": [
    "CVE-2022-49941"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-18T11:15:21Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: avoid call of sleeping functions from atomic context\n\nSyzkaller reports the following problem:\n\nBUG: sleeping function called from invalid context at kernel/printk/printk.c:2347\nin_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1105, name: syz-executor423\n3 locks held by syz-executor423/1105:\n #0: ffff8881468b9098 (\u0026tty-\u003eldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x90 drivers/tty/tty_ldisc.c:266\n #1: ffff8881468b9130 (\u0026tty-\u003eatomic_write_lock){+.+.}-{3:3}, at: tty_write_lock drivers/tty/tty_io.c:952 [inline]\n #1: ffff8881468b9130 (\u0026tty-\u003eatomic_write_lock){+.+.}-{3:3}, at: do_tty_write drivers/tty/tty_io.c:975 [inline]\n #1: ffff8881468b9130 (\u0026tty-\u003eatomic_write_lock){+.+.}-{3:3}, at: file_tty_write.constprop.0+0x2a8/0x8e0 drivers/tty/tty_io.c:1118\n #2: ffff88801b06c398 (\u0026gsm-\u003etx_lock){....}-{2:2}, at: gsmld_write+0x5e/0x150 drivers/tty/n_gsm.c:2717\nirq event stamp: 3482\nhardirqs last  enabled at (3481): [\u003cffffffff81d13343\u003e] __get_reqs_available+0x143/0x2f0 fs/aio.c:946\nhardirqs last disabled at (3482): [\u003cffffffff87d39722\u003e] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]\nhardirqs last disabled at (3482): [\u003cffffffff87d39722\u003e] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:159\nsoftirqs last  enabled at (3408): [\u003cffffffff87e01002\u003e] asm_call_irq_on_stack+0x12/0x20\nsoftirqs last disabled at (3401): [\u003cffffffff87e01002\u003e] asm_call_irq_on_stack+0x12/0x20\nPreemption disabled at:\n[\u003c0000000000000000\u003e] 0x0\nCPU: 2 PID: 1105 Comm: syz-executor423 Not tainted 5.10.137-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x107/0x167 lib/dump_stack.c:118\n ___might_sleep.cold+0x1e8/0x22e kernel/sched/core.c:7304\n console_lock+0x19/0x80 kernel/printk/printk.c:2347\n do_con_write+0x113/0x1de0 drivers/tty/vt/vt.c:2909\n con_write+0x22/0xc0 drivers/tty/vt/vt.c:3296\n gsmld_write+0xd0/0x150 drivers/tty/n_gsm.c:2720\n do_tty_write drivers/tty/tty_io.c:1028 [inline]\n file_tty_write.constprop.0+0x502/0x8e0 drivers/tty/tty_io.c:1118\n call_write_iter include/linux/fs.h:1903 [inline]\n aio_write+0x355/0x7b0 fs/aio.c:1580\n __io_submit_one fs/aio.c:1952 [inline]\n io_submit_one+0xf45/0x1a90 fs/aio.c:1999\n __do_sys_io_submit fs/aio.c:2058 [inline]\n __se_sys_io_submit fs/aio.c:2028 [inline]\n __x64_sys_io_submit+0x18c/0x2f0 fs/aio.c:2028\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nThe problem happens in the following control flow:\n\ngsmld_write(...)\nspin_lock_irqsave(\u0026gsm-\u003etx_lock, flags) // taken a spinlock on TX data\n con_write(...)\n  do_con_write(...)\n   console_lock()\n    might_sleep() // -\u003e bug\n\nAs far as console_lock() might sleep it should not be called with\nspinlock held.\n\nThe patch replaces tx_lock spinlock with mutex in order to avoid the\nproblem.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
  "id": "GHSA-f5rh-72cc-h8f7",
  "modified": "2025-06-18T12:30:35Z",
  "published": "2025-06-18T12:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49941"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/132331c1f605eb5911795a6b9115114575594d0a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/902e02ea9385373ce4b142576eef41c642703955"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eb75efdec8dd0f01ac85c88feafa6e63b34a2521"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}