In the Linux kernel, the following vulnerability has been resolved:
tty: serial: fsl_lpuart: fix race on RX DMA shutdown
From time to time DMA completion can come in the middle of DMA shutdown:
<process ctx>: <IRQ>: lpuart32shutdown() lpuartdmashutdown() deltimersync() lpuartdmarxcomplete() lpuartcopyrxtotty() modtimer() lpuartdmarxfree()
When the timer fires a bit later, sport->dmarxdesc is NULL:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 pc : lpuartcopyrxtotty+0xcc/0x5bc lr : lpuarttimerfunc+0x1c/0x2c Call trace: lpuartcopyrxtotty lpuarttimerfunc calltimerfn _runtimers.part.0 runtimersoftirq _dosoftirq _irqexitrcu irqexit handledomainirq gichandleirq callonirqstack dointerrupt_handler ...
To fix this fold deltimersync() into lpuartdmarxfree() after dmaengineterminatesync() to make sure timer will not be re-started in lpuartcopyrxtotty() <= lpuartdmarxcomplete().
{ "vanir_signatures": [ { "id": "CVE-2023-53094-13c4a168", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be6f2b15f902c02e055ae0b419ca789200473c9", "digest": { "function_hash": "184508807530018630585740669970414064124", "length": 3601.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-1fc368c2", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_suspend" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be6f2b15f902c02e055ae0b419ca789200473c9", "digest": { "function_hash": "178181531206077459259300453383593012097", "length": 1676.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-254fb566", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_shutdown" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@954fc9931f0aabf272b5674cf468affdd88d3a36", "digest": { "function_hash": "158123363835421946905383595100329765700", "length": 563.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-353befd8", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart32_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a36b444cace9580380467fd1183bb5e85bcc80a", "digest": { "function_hash": "190666684133103892571576552171140458625", "length": 3073.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-3625e774", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_suspend" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@954fc9931f0aabf272b5674cf468affdd88d3a36", "digest": { "function_hash": "49962874211923148406987140548602418772", "length": 1106.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-36c50bd9", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_suspend" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19a98d56dfedafb25652bdb9cd48a4e73ceba702", "digest": { "function_hash": "49962874211923148406987140548602418772", "length": 1106.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-44489dfa", "signature_type": "Line", "target": { "file": "drivers/tty/serial/fsl_lpuart.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90530e7214c8a04dcdde57502d93fa96af288c38", "digest": { "threshold": 0.9, "line_hashes": [ "253052838078401974623174357125978841828", "229178008089342147322402470556106836848", "40988720603035116689741453549360860986", "88036286060555557523651244033459447156", "185556855171152187487647983361504588093", "30601037485423989883120100319748840125", "62968302726347239758695401664434677343", "142523707520589292052907742596010161339", "220554030283408585768719923781290341790", "12663879556638941666675868240105809557", "91202570959462023565308105801514247217", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "37558770383783701251221815297813120952", "165453985466582932140897976090417798173", "37117598719923469859995971486671632910", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "256279247398181879180193478628642418573", "174284614364744103675310699371815574944", "9192224767884982704871592515086826432", "304166146995403696170780517387530481363" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-46acaf7e", "signature_type": "Line", "target": { "file": "drivers/tty/serial/fsl_lpuart.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19a98d56dfedafb25652bdb9cd48a4e73ceba702", "digest": { "threshold": 0.9, "line_hashes": [ "286158923797565829758946950133693113457", "309004157606837336193999305846690395926", "214238358133154282418707237645431606955", "247194916444501110628681597125851782521", "185556855171152187487647983361504588093", "30601037485423989883120100319748840125", "62968302726347239758695401664434677343", "142523707520589292052907742596010161339", "220554030283408585768719923781290341790", "12663879556638941666675868240105809557", "91202570959462023565308105801514247217", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "37558770383783701251221815297813120952", "165453985466582932140897976090417798173", "37117598719923469859995971486671632910", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "256279247398181879180193478628642418573", "174284614364744103675310699371815574944", "9192224767884982704871592515086826432", "304166146995403696170780517387530481363" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-51aa742f", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_shutdown" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90530e7214c8a04dcdde57502d93fa96af288c38", "digest": { "function_hash": "183073847326781541678862103815496977588", "length": 548.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-5412e941", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_suspend" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90530e7214c8a04dcdde57502d93fa96af288c38", "digest": { "function_hash": "49962874211923148406987140548602418772", "length": 1106.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-5a5ac5ce", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_rx_free" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be6f2b15f902c02e055ae0b419ca789200473c9", "digest": { "function_hash": "97657733736893423481955639850235593276", "length": 424.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-65189d96", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_rx_free" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19a98d56dfedafb25652bdb9cd48a4e73ceba702", "digest": { "function_hash": "97657733736893423481955639850235593276", "length": 424.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-68b21e87", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_shutdown" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be6f2b15f902c02e055ae0b419ca789200473c9", "digest": { "function_hash": "158123363835421946905383595100329765700", "length": 563.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-6b4c8340", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart32_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90530e7214c8a04dcdde57502d93fa96af288c38", "digest": { "function_hash": "226367318982714925990056444838905836635", "length": 3034.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-803dad67", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_suspend" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a36b444cace9580380467fd1183bb5e85bcc80a", "digest": { "function_hash": "178181531206077459259300453383593012097", "length": 1676.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-8226d25d", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart32_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19a98d56dfedafb25652bdb9cd48a4e73ceba702", "digest": { "function_hash": "34717866127074855471520907982695899473", "length": 2908.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-8b2befbe", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90530e7214c8a04dcdde57502d93fa96af288c38", "digest": { "function_hash": "95362300988246040274138390169382936349", "length": 3595.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-8ec06f69", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_rx_free" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90530e7214c8a04dcdde57502d93fa96af288c38", "digest": { "function_hash": "97657733736893423481955639850235593276", "length": 424.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-999e3207", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_rx_free" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a36b444cace9580380467fd1183bb5e85bcc80a", "digest": { "function_hash": "97657733736893423481955639850235593276", "length": 424.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-9e491420", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19a98d56dfedafb25652bdb9cd48a4e73ceba702", "digest": { "function_hash": "95362300988246040274138390169382936349", "length": 3595.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-b38be97b", "signature_type": "Line", "target": { "file": "drivers/tty/serial/fsl_lpuart.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be6f2b15f902c02e055ae0b419ca789200473c9", "digest": { "threshold": 0.9, "line_hashes": [ "253052838078401974623174357125978841828", "229178008089342147322402470556106836848", "40988720603035116689741453549360860986", "88036286060555557523651244033459447156", "185556855171152187487647983361504588093", "30601037485423989883120100319748840125", "62968302726347239758695401664434677343", "142523707520589292052907742596010161339", "220554030283408585768719923781290341790", "12663879556638941666675868240105809557", "91202570959462023565308105801514247217", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "37558770383783701251221815297813120952", "165453985466582932140897976090417798173", "37117598719923469859995971486671632910", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "206536129210776828727158568242115838410", "227817467605550599878064521149479840281", "112236047286994924799147204238444897462", "102242106472240267828387428102370448812" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-b8a4707c", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart32_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@954fc9931f0aabf272b5674cf468affdd88d3a36", "digest": { "function_hash": "268735271691296000565266280273051579513", "length": 3109.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-c341aa46", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@954fc9931f0aabf272b5674cf468affdd88d3a36", "digest": { "function_hash": "184508807530018630585740669970414064124", "length": 3601.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-cbb49f19", "signature_type": "Line", "target": { "file": "drivers/tty/serial/fsl_lpuart.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a36b444cace9580380467fd1183bb5e85bcc80a", "digest": { "threshold": 0.9, "line_hashes": [ "253052838078401974623174357125978841828", "229178008089342147322402470556106836848", "40988720603035116689741453549360860986", "88036286060555557523651244033459447156", "185556855171152187487647983361504588093", "30601037485423989883120100319748840125", "62968302726347239758695401664434677343", "142523707520589292052907742596010161339", "220554030283408585768719923781290341790", "12663879556638941666675868240105809557", "91202570959462023565308105801514247217", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "37558770383783701251221815297813120952", "165453985466582932140897976090417798173", "37117598719923469859995971486671632910", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "206536129210776828727158568242115838410", "227817467605550599878064521149479840281", "112236047286994924799147204238444897462", "102242106472240267828387428102370448812" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-d1ef466c", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_shutdown" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19a98d56dfedafb25652bdb9cd48a4e73ceba702", "digest": { "function_hash": "183073847326781541678862103815496977588", "length": 548.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-dd8ad169", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_rx_free" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@954fc9931f0aabf272b5674cf468affdd88d3a36", "digest": { "function_hash": "97657733736893423481955639850235593276", "length": 424.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-e17a11f7", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart32_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be6f2b15f902c02e055ae0b419ca789200473c9", "digest": { "function_hash": "268735271691296000565266280273051579513", "length": 3109.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-e38a5836", "signature_type": "Line", "target": { "file": "drivers/tty/serial/fsl_lpuart.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@954fc9931f0aabf272b5674cf468affdd88d3a36", "digest": { "threshold": 0.9, "line_hashes": [ "253052838078401974623174357125978841828", "229178008089342147322402470556106836848", "40988720603035116689741453549360860986", "88036286060555557523651244033459447156", "185556855171152187487647983361504588093", "30601037485423989883120100319748840125", "62968302726347239758695401664434677343", "142523707520589292052907742596010161339", "220554030283408585768719923781290341790", "12663879556638941666675868240105809557", "91202570959462023565308105801514247217", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "37558770383783701251221815297813120952", "165453985466582932140897976090417798173", "37117598719923469859995971486671632910", "43989184203969899839786945397662926877", "82048664561821352223650345864239896232", "294001142508030983281537269304982889372", "231749925209351519792439023328256359355", "256279247398181879180193478628642418573", "174284614364744103675310699371815574944", "9192224767884982704871592515086826432", "304166146995403696170780517387530481363" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-e6a9d7e9", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_dma_shutdown" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a36b444cace9580380467fd1183bb5e85bcc80a", "digest": { "function_hash": "158123363835421946905383595100329765700", "length": 563.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53094-fbca30ac", "signature_type": "Function", "target": { "file": "drivers/tty/serial/fsl_lpuart.c", "function": "lpuart_set_termios" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a36b444cace9580380467fd1183bb5e85bcc80a", "digest": { "function_hash": "184508807530018630585740669970414064124", "length": 3601.0 }, "deprecated": false, "signature_version": "v1" } ] }