CVE-2024-57889

Description

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ... preempt_count: 1, expected: 0 ... Call Trace: ... __might_resched+0x104/0x10e __might_sleep+0x3e/0x62 mutex_lock+0x20/0x4c regmap_lock_mutex+0x10/0x18 regmap_update_bits_base+0x2c/0x66 mcp23s08_irq_set_type+0x1ae/0x1d6 __irq_set_trigger+0x56/0x172 __setup_irq+0x1e6/0x646 request_threaded_irq+0xb6/0x160 ... We observed the problem while experimenting with a touchscreen driver which used MCP23017 IO expander (I2C). The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from concurrent accesses, which is the default for regmaps without .fast_io, .disable_locking, etc. mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter locks the mutex. However, __setup_irq() locks desc->lock spinlock before calling these functions. As a result, the system tries to lock the mutex whole holding the spinlock. It seems, the internal regmap locks are not needed in this driver at all. mcp->lock seems to protect the regmap from concurrent accesses already, except, probably, in mcp_pinconf_get/set. mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under chip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes mcp->lock and enables regmap caching, so that the potentially slow I2C accesses are deferred until chip_bus_unlock(). The accesses to the regmap from mcp23s08_probe_one() do not need additional locking. In all remaining places where the regmap is accessed, except mcp_pinconf_get/set(), the driver already takes mcp->lock. This patch adds locking in mcp_pinconf_get/set() and disables internal locking in the regmap config. Among other things, it fixes the sleeping in atomic context described above.

Gravité et risque d'exploitation

CVE-2024-57889 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.17 %, ce qui la place devant 5.4 % des CVE référencées.

Que faire ?

• Vérifiez si Linux (versions 6.13, <=6.1.*, <=6.12.*, 0, 5.10.233, <0310cbad163a908d09d99c26827859365cd71fcb, 5.15.176, <788d9e9a41b81893d6bb8faa05f045c975278318, <c55d186376a87b468c9ee30f2195e0f3857f61a0, <=5.10.*, <=6.6.*, 6.12.9, 4.13, <8c6fd5803b988a5e78c9b9e42c70a936d7cfc6ec, <=5.4.*, <830f838589522404cd7c2f0f540602f25034af61, 6.1.124, 8f38910ba4f662222157ce07a0d5becc4328c46a, 6.6.70, <9372e160d8211a7e17f2abff8370794f182df785, <4.13, <=*, <a37eecb705f33726f1fb7cd2a67e514a15dfe693, <=5.15.*, 5.4.289) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://git.kernel.org/stable/c/788d9e9a41b81893d6bb8faa05f045c975278318
• https://git.kernel.org/stable/c/c55d186376a87b468c9ee30f2195e0f3857f61a0
• https://git.kernel.org/stable/c/9372e160d8211a7e17f2abff8370794f182df785
• https://git.kernel.org/stable/c/0310cbad163a908d09d99c26827859365cd71fcb
• https://git.kernel.org/stable/c/8c6fd5803b988a5e78c9b9e42c70a936d7cfc6ec
• https://git.kernel.org/stable/c/830f838589522404cd7c2f0f540602f25034af61
• https://git.kernel.org/stable/c/a37eecb705f33726f1fb7cd2a67e514a15dfe693