Bug 2348122 (CVE-2022-49371) - CVE-2022-49371 kernel: driver core: fix deadlock in __device_attach
Summary: CVE-2022-49371 kernel: driver core: fix deadlock in __device_attach
Keywords:
Status: NEW
Alias: CVE-2022-49371
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-26 03:18 UTC by OSIDB Bzimport
Modified: 2025-05-05 14:09 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-26 03:18:22 UTC
In the Linux kernel, the following vulnerability has been resolved:

driver core: fix deadlock in __device_attach

In __device_attach function, The lock holding logic is as follows:
...
__device_attach
device_lock(dev)      // get lock dev
  async_schedule_dev(__device_attach_async_helper, dev); // func
    async_schedule_node
      async_schedule_node_domain(func)
        entry = kzalloc(sizeof(struct async_entry), GFP_ATOMIC);
	/* when fail or work limit, sync to execute func, but
	   __device_attach_async_helper will get lock dev as
	   well, which will lead to A-A deadlock.  */
	if (!entry || atomic_read(&entry_count) > MAX_WORK) {
	  func;
	else
	  queue_work_node(node, system_unbound_wq, &entry->work)
  device_unlock(dev)

As shown above, when it is allowed to do async probes, because of
out of memory or work limit, async work is not allowed, to do
sync execute instead. it will lead to A-A deadlock because of
__device_attach_async_helper getting lock dev.

To fix the deadlock, move the async_schedule_dev outside device_lock,
as we can see, in async_schedule_node_domain, the parameter of
queue_work_node is system_unbound_wq, so it can accept concurrent
operations. which will also not change the code logic, and will
not lead to deadlock.

Comment 1 Avinash Hanwate 2025-02-26 11:26:40 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022646-CVE-2022-49371-30f9@gregkh/T

Comment 4 Avinash Hanwate 2025-02-26 15:57:58 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022646-CVE-2022-49371-30f9@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.