In the Linux kernel, the following vulnerability has been resolved:
drivers: tty: serial: Fix deadlock in sa1100settermios()
There is a deadlock in sa1100settermios(), which is shown below:
(Thread 1) | (Thread 2) | sa1100enablems() sa1100settermios() | modtimer() spinlockirqsave() //(1) | (wait a time) ... | sa1100timeout() deltimersync() | spinlockirqsave() //(2) (wait timer to stop) | ...
We hold sport->port.lock in position (1) of thread 1 and use deltimersync() to wait timer to stop, but timer handler also need sport->port.lock in position (2) of thread 2. As a result, sa1100settermios() will block forever.
This patch moves deltimersync() before spinlockirqsave() in order to prevent the deadlock.
[
{
"id": "CVE-2022-49304-18bd4e73",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0976808d0d171ec837d4bd3e9f4ad4a00ab703b8"
},
{
"id": "CVE-2022-49304-29d26060",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09a5958a2452ad22d0cb638711ef34ea1863a829"
},
{
"id": "CVE-2022-49304-36f09e75",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34d91e555e5582cffdbcbb75517bc9217866823e"
},
{
"id": "CVE-2022-49304-3a4a7621",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34d91e555e5582cffdbcbb75517bc9217866823e"
},
{
"id": "CVE-2022-49304-43145e64",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e2273eefab54a521d9c59efb6e1114e742bdf41"
},
{
"id": "CVE-2022-49304-4a4f9d9f",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e2273eefab54a521d9c59efb6e1114e742bdf41"
},
{
"id": "CVE-2022-49304-4fb349ec",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@920f0ae7a129ffee98a106e3bbdfd61a2a59e939"
},
{
"id": "CVE-2022-49304-57df7df4",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@920f0ae7a129ffee98a106e3bbdfd61a2a59e939"
},
{
"id": "CVE-2022-49304-6758ff25",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0976808d0d171ec837d4bd3e9f4ad4a00ab703b8"
},
{
"id": "CVE-2022-49304-6b3c943f",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85e20f8bd31a46d8c60103d0274a8ebe8f47f2b2"
},
{
"id": "CVE-2022-49304-706d1a33",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85e20f8bd31a46d8c60103d0274a8ebe8f47f2b2"
},
{
"id": "CVE-2022-49304-77c95121",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62b2caef400c1738b6d22f636c628d9f85cd4c4c"
},
{
"id": "CVE-2022-49304-80d5f397",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@553213432ef0c295becdc08c0207d2094468f673"
},
{
"id": "CVE-2022-49304-91aec36a",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09a5958a2452ad22d0cb638711ef34ea1863a829"
},
{
"id": "CVE-2022-49304-b144f8a9",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@553213432ef0c295becdc08c0207d2094468f673"
},
{
"id": "CVE-2022-49304-c7600f88",
"deprecated": false,
"digest": {
"line_hashes": [
"20743627805752877537959482800093937255",
"328489750288675365603451996654143854953",
"13365248560408431371826237657909685285",
"156056161702142702236901057392778756034",
"274680372827392655382783689065067082218",
"126014449627383426149186427933751149444",
"231243720551329616912194048278972721913"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cbfc38df580bff5b2fe19f21c1a7520efcc4b3b"
},
{
"id": "CVE-2022-49304-ed5658ee",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62b2caef400c1738b6d22f636c628d9f85cd4c4c"
},
{
"id": "CVE-2022-49304-ed7cdde8",
"deprecated": false,
"digest": {
"length": 2091.0,
"function_hash": "281171784073718036416314210847166187434"
},
"signature_version": "v1",
"target": {
"function": "sa1100_set_termios",
"file": "drivers/tty/serial/sa1100.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cbfc38df580bff5b2fe19f21c1a7520efcc4b3b"
}
]