In the Linux kernel, the following vulnerability has been resolved:
dma-debug: don't call _dmaentryalloccheckleak() under freeentries_lock
_dmaentryalloccheckleak() calls into printk -> serial console output (qcom geni) and grabs port->lock under freeentrieslock spin lock, which is a reverse locking dependency chain as qcomgeni IRQ handler can call into dma-debug code and grab freeentrieslock under port->lock.
Move _dmaentryalloccheckleak() call out of freeentries_lock scope so that we don't acquire serial console's port->lock under it.
Trimmed-down lockdep splat:
The existing dependency chain (in reverse order) is:
-> #2 (free_entries_lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
dma_entry_alloc+0x38/0x110
debug_dma_map_page+0x60/0xf8
dma_map_page_attrs+0x1e0/0x230
dma_map_single_attrs.constprop.0+0x6c/0xc8
geni_se_rx_dma_prep+0x40/0xcc
qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244
handle_irq_event_percpu+0x20/0x54
handle_irq_event+0x50/0x88
handle_fasteoi_irq+0xa4/0xcc
handle_irq_desc+0x28/0x40
generic_handle_domain_irq+0x24/0x30
gic_handle_irq+0xc4/0x148
do_interrupt_handler+0xa4/0xb0
el1_interrupt+0x34/0x64
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x64/0x68
arch_local_irq_enable+0x4/0x8
____do_softirq+0x18/0x24
...
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
qcom_geni_serial_console_write+0x184/0x1dc
console_flush_all+0x344/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
register_console+0x230/0x38c
uart_add_one_port+0x338/0x494
qcom_geni_serial_probe+0x390/0x424
platform_probe+0x70/0xc0
really_probe+0x148/0x280
__driver_probe_device+0xfc/0x114
driver_probe_device+0x44/0x100
__device_attach_driver+0x64/0xdc
bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140
device_initial_probe+0x1c/0x28
bus_probe_device+0x44/0xb0
device_add+0x538/0x668
of_device_add+0x44/0x50
of_platform_device_create_pdata+0x94/0xc8
of_platform_bus_create+0x270/0x304
of_platform_populate+0xac/0xc4
devm_of_platform_populate+0x60/0xac
geni_se_probe+0x154/0x160
platform_probe+0x70/0xc0
...
-> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Chain exists of: consoleowner --> &portlockkey --> freeentries_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(freeentrieslock); lock(&portlockkey); lock(freeentrieslock); lock(console_owner);
*** DEADLOCK ***
Call trace: dumpbacktrace+0xb4/0xf0 showstack+0x20/0x30 dumpstacklvl+0x60/0x84 dumpstack+0x18/0x24 printcircularbug+0x1cc/0x234 checknoncircular+0x78/0xac _lockacquire+0xdf8/0x109c lockacquire+0x234/0x284 consoleflush_all+0x330/0x454 consol ---truncated---
[
{
"id": "CVE-2023-52516-0866a9ce",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182796532138024072053117945159299016405",
"159964181685913424562107346656184918720",
"210796840465647428381439074040924395555",
"213010400972175455518538688132449631890",
"126289604416630632396264296574010622596",
"245146634722135109668124227264089836355",
"5194604680103520258785912175089796539",
"107714152756496316106325844960092151284",
"296831446643042859274867064107064499034",
"59198141307699143889990499723177230396",
"152577783838630853581981279628716516205",
"77655166763700953624148998024832667063",
"19946284597898929083641851071192497984",
"242810457977352537866272866999482329167",
"262705950321809678110082458536663609918",
"161367373464562394324211775330637385054",
"262804209600653615974668356953456345080",
"172886676462459785315209516002459186521",
"174710591281525533579056314853481667135",
"321461313051041292454129212400233162499",
"46241593836512033923066967864105750124",
"317436580163373438555671019797247297960",
"223298146487222157617974141671781467260"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be8f49029eca3efbad0d74dbff3cb9129994ffab",
"target": {
"file": "kernel/dma/debug.c"
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52516-457b48cb",
"digest": {
"function_hash": "285549312433684333453538940655832662396",
"length": 256.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2b811a02c3244ebf6059039e4a9e715e26a9e3",
"target": {
"function": "__dma_entry_alloc_check_leak",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-560fc376",
"digest": {
"function_hash": "285549312433684333453538940655832662396",
"length": 256.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be8f49029eca3efbad0d74dbff3cb9129994ffab",
"target": {
"function": "__dma_entry_alloc_check_leak",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-5676b3a0",
"digest": {
"function_hash": "285549312433684333453538940655832662396",
"length": 256.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac0d068099349cbca3d93f2e3b15bb329364b08c",
"target": {
"function": "__dma_entry_alloc_check_leak",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-5c9ff488",
"digest": {
"function_hash": "285549312433684333453538940655832662396",
"length": 256.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb5a4315591dae307a65fc246ca80b5159d296e1",
"target": {
"function": "__dma_entry_alloc_check_leak",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-5cb360dd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182796532138024072053117945159299016405",
"159964181685913424562107346656184918720",
"210796840465647428381439074040924395555",
"213010400972175455518538688132449631890",
"126289604416630632396264296574010622596",
"245146634722135109668124227264089836355",
"5194604680103520258785912175089796539",
"107714152756496316106325844960092151284",
"296831446643042859274867064107064499034",
"59198141307699143889990499723177230396",
"152577783838630853581981279628716516205",
"77655166763700953624148998024832667063",
"19946284597898929083641851071192497984",
"242810457977352537866272866999482329167",
"262705950321809678110082458536663609918",
"161367373464562394324211775330637385054",
"262804209600653615974668356953456345080",
"172886676462459785315209516002459186521",
"174710591281525533579056314853481667135",
"321461313051041292454129212400233162499",
"46241593836512033923066967864105750124",
"317436580163373438555671019797247297960",
"223298146487222157617974141671781467260"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb5a4315591dae307a65fc246ca80b5159d296e1",
"target": {
"file": "kernel/dma/debug.c"
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52516-8af7930f",
"digest": {
"function_hash": "297459539081201614471443370406575950144",
"length": 534.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c79300599923daaa30f417c75555d5566b3d31ae",
"target": {
"function": "dma_entry_alloc",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-941aa7b1",
"digest": {
"function_hash": "297459539081201614471443370406575950144",
"length": 534.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb5a4315591dae307a65fc246ca80b5159d296e1",
"target": {
"function": "dma_entry_alloc",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-98f49b9b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182796532138024072053117945159299016405",
"159964181685913424562107346656184918720",
"210796840465647428381439074040924395555",
"213010400972175455518538688132449631890",
"126289604416630632396264296574010622596",
"245146634722135109668124227264089836355",
"5194604680103520258785912175089796539",
"107714152756496316106325844960092151284",
"296831446643042859274867064107064499034",
"59198141307699143889990499723177230396",
"152577783838630853581981279628716516205",
"77655166763700953624148998024832667063",
"19946284597898929083641851071192497984",
"242810457977352537866272866999482329167",
"262705950321809678110082458536663609918",
"161367373464562394324211775330637385054",
"262804209600653615974668356953456345080",
"172886676462459785315209516002459186521",
"174710591281525533579056314853481667135",
"321461313051041292454129212400233162499",
"46241593836512033923066967864105750124",
"317436580163373438555671019797247297960",
"223298146487222157617974141671781467260"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac0d068099349cbca3d93f2e3b15bb329364b08c",
"target": {
"file": "kernel/dma/debug.c"
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52516-b6042efc",
"digest": {
"function_hash": "297459539081201614471443370406575950144",
"length": 534.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be8f49029eca3efbad0d74dbff3cb9129994ffab",
"target": {
"function": "dma_entry_alloc",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-bb0953a3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182796532138024072053117945159299016405",
"159964181685913424562107346656184918720",
"210796840465647428381439074040924395555",
"213010400972175455518538688132449631890",
"126289604416630632396264296574010622596",
"245146634722135109668124227264089836355",
"5194604680103520258785912175089796539",
"107714152756496316106325844960092151284",
"296831446643042859274867064107064499034",
"59198141307699143889990499723177230396",
"152577783838630853581981279628716516205",
"77655166763700953624148998024832667063",
"19946284597898929083641851071192497984",
"242810457977352537866272866999482329167",
"262705950321809678110082458536663609918",
"161367373464562394324211775330637385054",
"262804209600653615974668356953456345080",
"172886676462459785315209516002459186521",
"174710591281525533579056314853481667135",
"321461313051041292454129212400233162499",
"46241593836512033923066967864105750124",
"317436580163373438555671019797247297960",
"223298146487222157617974141671781467260"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2b811a02c3244ebf6059039e4a9e715e26a9e3",
"target": {
"file": "kernel/dma/debug.c"
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52516-bcdd5d4e",
"digest": {
"function_hash": "285549312433684333453538940655832662396",
"length": 256.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c79300599923daaa30f417c75555d5566b3d31ae",
"target": {
"function": "__dma_entry_alloc_check_leak",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-ca033b9e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182796532138024072053117945159299016405",
"159964181685913424562107346656184918720",
"210796840465647428381439074040924395555",
"213010400972175455518538688132449631890",
"126289604416630632396264296574010622596",
"245146634722135109668124227264089836355",
"5194604680103520258785912175089796539",
"107714152756496316106325844960092151284",
"296831446643042859274867064107064499034",
"59198141307699143889990499723177230396",
"152577783838630853581981279628716516205",
"77655166763700953624148998024832667063",
"19946284597898929083641851071192497984",
"242810457977352537866272866999482329167",
"262705950321809678110082458536663609918",
"161367373464562394324211775330637385054",
"262804209600653615974668356953456345080",
"172886676462459785315209516002459186521",
"174710591281525533579056314853481667135",
"321461313051041292454129212400233162499",
"46241593836512033923066967864105750124",
"317436580163373438555671019797247297960",
"223298146487222157617974141671781467260"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c79300599923daaa30f417c75555d5566b3d31ae",
"target": {
"file": "kernel/dma/debug.c"
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52516-e0f31a5a",
"digest": {
"function_hash": "297459539081201614471443370406575950144",
"length": 534.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac0d068099349cbca3d93f2e3b15bb329364b08c",
"target": {
"function": "dma_entry_alloc",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52516-f3e661ce",
"digest": {
"function_hash": "297459539081201614471443370406575950144",
"length": 534.0
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2b811a02c3244ebf6059039e4a9e715e26a9e3",
"target": {
"function": "dma_entry_alloc",
"file": "kernel/dma/debug.c"
},
"signature_type": "Function"
}
]