In the Linux kernel, the following vulnerability has been resolved:
drivers: staging: rtl8192e: Fix deadlock in rtllibbeaconsstop()
There is a deadlock in rtllibbeaconsstop(), which is shown below:
(Thread 1) | (Thread 2) | rtllibsendbeacon() rtllibbeaconsstop() | modtimer() spinlockirqsave() //(1) | (wait a time) ... | rtllibsendbeaconcb() deltimersync() | spinlockirqsave() //(2) (wait timer to stop) | ...
We hold ieee->beaconlock in position (1) of thread 1 and use deltimersync() to wait timer to stop, but timer handler also need ieee->beaconlock in position (2) of thread 2. As a result, rtllibbeaconsstop() will block forever.
This patch extracts deltimersync() from the protection of spinlockirqsave(), which could let timer handler to obtain the needed lock.
[
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c",
"function": "rtllib_beacons_stop"
},
"digest": {
"length": 219.0,
"function_hash": "162084204473686808988560032162390359480"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fef451f0fbbe85dbd2962b18379d02e2965610db",
"signature_version": "v1",
"id": "CVE-2022-49315-0aa4f0fb"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c"
},
"digest": {
"line_hashes": [
"42165264800563504709064141245105154257",
"335490778857769804395887686304905799588",
"326106736010244996026759725804724753821",
"299292858076811818679611976043326268458",
"87909975098280032383576371827248912400"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4681129fda9e8555392eaaadb239ec6a6e2b3e12",
"signature_version": "v1",
"id": "CVE-2022-49315-25ca8b41"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c"
},
"digest": {
"line_hashes": [
"42165264800563504709064141245105154257",
"335490778857769804395887686304905799588",
"326106736010244996026759725804724753821",
"299292858076811818679611976043326268458",
"87909975098280032383576371827248912400"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b6bdbd9337de3917945847bde262a34a87a6303",
"signature_version": "v1",
"id": "CVE-2022-49315-2c9c8b42"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c"
},
"digest": {
"line_hashes": [
"42165264800563504709064141245105154257",
"335490778857769804395887686304905799588",
"326106736010244996026759725804724753821",
"299292858076811818679611976043326268458",
"87909975098280032383576371827248912400"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64b05fa212c7e4d057676e8b7e7120c6eb2f615b",
"signature_version": "v1",
"id": "CVE-2022-49315-2d63f34b"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c",
"function": "rtllib_beacons_stop"
},
"digest": {
"length": 219.0,
"function_hash": "162084204473686808988560032162390359480"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4681129fda9e8555392eaaadb239ec6a6e2b3e12",
"signature_version": "v1",
"id": "CVE-2022-49315-3e490828"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c",
"function": "rtllib_beacons_stop"
},
"digest": {
"length": 219.0,
"function_hash": "162084204473686808988560032162390359480"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46c861009bf437a18417df24cea0d181741b7d72",
"signature_version": "v1",
"id": "CVE-2022-49315-4bff84d1"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c"
},
"digest": {
"line_hashes": [
"42165264800563504709064141245105154257",
"335490778857769804395887686304905799588",
"326106736010244996026759725804724753821",
"299292858076811818679611976043326268458",
"87909975098280032383576371827248912400"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46c861009bf437a18417df24cea0d181741b7d72",
"signature_version": "v1",
"id": "CVE-2022-49315-535962ac"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c"
},
"digest": {
"line_hashes": [
"42165264800563504709064141245105154257",
"335490778857769804395887686304905799588",
"326106736010244996026759725804724753821",
"299292858076811818679611976043326268458",
"87909975098280032383576371827248912400"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fef451f0fbbe85dbd2962b18379d02e2965610db",
"signature_version": "v1",
"id": "CVE-2022-49315-5f4cacbf"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c",
"function": "rtllib_beacons_stop"
},
"digest": {
"length": 219.0,
"function_hash": "162084204473686808988560032162390359480"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b6bdbd9337de3917945847bde262a34a87a6303",
"signature_version": "v1",
"id": "CVE-2022-49315-ba1386c7"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/staging/rtl8192e/rtllib_softmac.c",
"function": "rtllib_beacons_stop"
},
"digest": {
"length": 219.0,
"function_hash": "162084204473686808988560032162390359480"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64b05fa212c7e4d057676e8b7e7120c6eb2f615b",
"signature_version": "v1",
"id": "CVE-2022-49315-de1fe218"
}
]