In the Linux kernel, the following vulnerability has been resolved:
i3c: Use i3cdev->desc->info instead of calling i3cdeviceget_info() to avoid deadlock
A deadlock may happen since the i3cmasterregister() acquires &i3cbus->lock twice. See the log below. Use i3cdev->desc->info instead of calling i3cdeviceinfo() to avoid acquiring the lock twice.
v2: - Modified the title and commit message
============================================ WARNING: possible recursive locking detected
init/1 is trying to acquire lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3cbusnormaluse_lock
but task is already holding lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3cmasterregister
other info that might help us debug this: Possible unsafe locking scenario:
CPU0
----
lock(&i3cbus->lock); lock(&i3cbus->lock);
* DEADLOCK *
May be due to missing lock nesting notation
2 locks held by init/1: #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: _driverattach #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3cmasterregister
stack backtrace: CPU: 6 UID: 0 PID: 1 Comm: init Call trace: dumpbacktrace+0xfc/0x17c showstack+0x18/0x28 dumpstacklvl+0x40/0xc0 dumpstack+0x18/0x24 printdeadlockbug+0x388/0x390 _lockacquire+0x18bc/0x32ec lockacquire+0x134/0x2b0 downread+0x50/0x19c i3cbusnormaluselock+0x14/0x24 i3cdevicegetinfo+0x24/0x58 i3cdeviceuevent+0x34/0xa4 devuevent+0x310/0x384 kobjectueventenv+0x244/0x414 kobjectuevent+0x14/0x20 deviceadd+0x278/0x460 deviceregister+0x20/0x34 i3cmasterregisternewi3cdevs+0x78/0x154 i3cmasterregister+0x6a0/0x6d4 mtki3cmasterprobe+0x3b8/0x4d8 platformprobe+0xa0/0xe0 reallyprobe+0x114/0x454 _driverprobedevice+0xa0/0x15c driverprobedevice+0x3c/0x1ac _driverattach+0xc4/0x1f0 busforeachdev+0x104/0x160 driverattach+0x24/0x34 busadddriver+0x14c/0x294 driverregister+0x68/0x104 _platformdriverregister+0x20/0x30 initmodule+0x20/0xfe4 dooneinitcall+0x184/0x464 doinitmodule+0x58/0x1ec loadmodule+0xefc/0x10c8 _arm64sysfinitmodule+0x238/0x33c invokesyscall+0x58/0x10c el0svccommon+0xa8/0xdc doel0svc+0x1c/0x28 el0svc+0x50/0xac el0t64synchandler+0x70/0xbc el0t64_sync+0x1a8/0x1ac
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@816187b1833908941286e71b0041059a4acd52ed",
"target": {
"file": "drivers/i3c/master.c",
"function": "i3c_device_uevent"
},
"id": "CVE-2024-43098-42e90d88",
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 467.0,
"function_hash": "193811135201044124652234451088257634965"
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d98fa2a50b8058de52ada168fa5dbabb574711b",
"target": {
"file": "drivers/i3c/master.c",
"function": "i3c_device_uevent"
},
"id": "CVE-2024-43098-44a47bb1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 467.0,
"function_hash": "193811135201044124652234451088257634965"
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ac1dd51aaa0ce8b5421d1137e857955a4b6f55e",
"target": {
"file": "drivers/i3c/master.c",
"function": "i3c_device_uevent"
},
"id": "CVE-2024-43098-5c736f8d",
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 467.0,
"function_hash": "193811135201044124652234451088257634965"
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cf7b65f7029914dc0cd7db86fac9ee5159008c6",
"target": {
"file": "drivers/i3c/master.c",
"function": "i3c_device_uevent"
},
"id": "CVE-2024-43098-6dc2512f",
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 479.0,
"function_hash": "261329498619273221215668763289777119529"
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@816187b1833908941286e71b0041059a4acd52ed",
"target": {
"file": "drivers/i3c/master.c"
},
"id": "CVE-2024-43098-87906767",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312715246284087078673692831583207918799",
"285385707887327414857440444373937267544",
"225359609727280078224352925705795337948",
"124798260443340146427721281612430537258"
]
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffe19e363c6f8b992ba835a361542568dea17409",
"target": {
"file": "drivers/i3c/master.c",
"function": "i3c_device_uevent"
},
"id": "CVE-2024-43098-88afcbbe",
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 479.0,
"function_hash": "261329498619273221215668763289777119529"
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d98fa2a50b8058de52ada168fa5dbabb574711b",
"target": {
"file": "drivers/i3c/master.c"
},
"id": "CVE-2024-43098-89c8ef85",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312715246284087078673692831583207918799",
"285385707887327414857440444373937267544",
"225359609727280078224352925705795337948",
"124798260443340146427721281612430537258"
]
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cf7b65f7029914dc0cd7db86fac9ee5159008c6",
"target": {
"file": "drivers/i3c/master.c"
},
"id": "CVE-2024-43098-a6521384",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150591209852059294551601570653909374422",
"285385707887327414857440444373937267544",
"225359609727280078224352925705795337948",
"124798260443340146427721281612430537258"
]
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f51ae217d09c361ede900b94735a6d2df6c0344",
"target": {
"file": "drivers/i3c/master.c"
},
"id": "CVE-2024-43098-ad7e8e7b",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150591209852059294551601570653909374422",
"285385707887327414857440444373937267544",
"225359609727280078224352925705795337948",
"124798260443340146427721281612430537258"
]
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f51ae217d09c361ede900b94735a6d2df6c0344",
"target": {
"file": "drivers/i3c/master.c",
"function": "i3c_device_uevent"
},
"id": "CVE-2024-43098-c42bd303",
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 479.0,
"function_hash": "261329498619273221215668763289777119529"
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffe19e363c6f8b992ba835a361542568dea17409",
"target": {
"file": "drivers/i3c/master.c"
},
"id": "CVE-2024-43098-d63feecc",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150591209852059294551601570653909374422",
"285385707887327414857440444373937267544",
"225359609727280078224352925705795337948",
"124798260443340146427721281612430537258"
]
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ac1dd51aaa0ce8b5421d1137e857955a4b6f55e",
"target": {
"file": "drivers/i3c/master.c"
},
"id": "CVE-2024-43098-f0c35cdd",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312715246284087078673692831583207918799",
"285385707887327414857440444373937267544",
"225359609727280078224352925705795337948",
"124798260443340146427721281612430537258"
]
},
"signature_version": "v1"
}
]