In the Linux kernel, the following vulnerability has been resolved:
dma-debug: fix a possible deadlock on radix_lock
radixlock() shouldn't be held while holding dmahashentry[idx].lock otherwise, there's a possible deadlock scenario when dma debug API is called holding rqlock():
CPU0 CPU1 CPU2 dmafreeattrs() checkunmap() adddmaentry() _schedule() //out (A) rqlock() gethashbucket() (A) dmaentryhash checksync() (A) radixlock() (W) dmaentryhash dmaentryfree() (W) radixlock() // CPU2's one (W) rq_lock()
CPU1 situation can happen when it extending radix tree and it tries to wake up kswapd via wakeallkswapd().
CPU2 situation can happen while perfeventtaskschedout() (i.e. dma sync operation is called while deleting perf_event using etm and etr tmc which are Arm Coresight hwtracing driver backends).
To remove this possible situation, call dmaentryfree() after puthashbucket() in check_unmap().