In the Linux kernel, the following vulnerability has been resolved:
isdn: mISDN: Fix sleeping function called from invalid context
The driver can call card->isac.release() function from an atomic context.
Fix this by calling this function after releasing the lock.
The following log reveals it:
[ 44.168226 ] BUG: sleeping function called from invalid context at kernel/workqueue.c:3018 [ 44.168941 ] inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 5475, name: modprobe [ 44.169574 ] INFO: lockdep is turned off. [ 44.169899 ] irq event stamp: 0 [ 44.170160 ] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 44.170627 ] hardirqs last disabled at (0): [<ffffffff814209ed>] copyprocess+0x132d/0x3e00 [ 44.171240 ] softirqs last enabled at (0): [<ffffffff81420a1a>] copyprocess+0x135a/0x3e00 [ 44.171852 ] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 44.172318 ] Preemption disabled at: [ 44.172320 ] [<ffffffffa009b0a9>] njrelease+0x69/0x500 [netjet] [ 44.174441 ] Call Trace: [ 44.174630 ] dumpstacklvl+0xa8/0xd1 [ 44.174912 ] dump_stack+0x15/0x17 [ 44.175166 ] ___mightsleep+0x3a2/0x510 [ 44.175459 ] ? njrelease+0x69/0x500 [netjet] [ 44.175791 ] __mightsleep+0x82/0xe0 [ 44.176063 ] ? startflushwork+0x20/0x7b0 [ 44.176375 ] startflushwork+0x33/0x7b0 [ 44.176672 ] ? traceirqenablercuidle+0x85/0x170 [ 44.177034 ] ? kasanquarantineput+0xaa/0x1f0 [ 44.177372 ] ? kasanquarantineput+0xaa/0x1f0 [ 44.177711 ] __flushwork+0x11a/0x1a0 [ 44.177991 ] ? flushwork+0x20/0x20 [ 44.178257 ] ? lock_release+0x13c/0x8f0 [ 44.178550 ] ? __kasancheckwrite+0x14/0x20 [ 44.178872 ] ? dorawspinlock+0x148/0x360 [ 44.179187 ] ? readlockisrecursive+0x20/0x20 [ 44.179530 ] ? __kasancheckread+0x11/0x20 [ 44.179846 ] ? do_rawspinunlock+0x55/0x900 [ 44.180168 ] ? ___kasanslabfree+0x116/0x140 [ 44.180505 ] ? rawspinunlockirqrestore+0x41/0x60 [ 44.180878 ] ? skbqueuepurge+0x1a3/0x1c0 [ 44.181189 ] ? kfree+0x13e/0x290 [ 44.181438 ] flushwork+0x17/0x20 [ 44.181695 ] mISDNfreedchannel+0xe8/0x100 [ 44.182006 ] isacrelease+0x210/0x260 [mISDNipac] [ 44.182366 ] njrelease+0xf6/0x500 [netjet] [ 44.182685 ] njremove+0x48/0x70 [netjet] [ 44.182989 ] pcideviceremove+0xa9/0x250
[
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.290"
}
]
},
{
"events": [
{
"introduced": "4.5"
},
{
"fixed": "4.9.288"
}
]
},
{
"events": [
{
"introduced": "4.10"
},
{
"fixed": "4.14.253"
}
]
},
{
"events": [
{
"introduced": "4.15"
},
{
"fixed": "4.19.214"
}
]
},
{
"events": [
{
"introduced": "4.20"
},
{
"fixed": "5.4.156"
}
]
},
{
"events": [
{
"introduced": "5.5"
},
{
"fixed": "5.10.76"
}
]
},
{
"events": [
{
"introduced": "5.11"
},
{
"fixed": "5.14.15"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.15-rc1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.15-rc2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.15-rc3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.15-rc4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.15-rc5"
}
]
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47468.json"