Description
In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on last dma_fence_put(). In some scenarios, it can run in IRQ context, which is not safe unless TIMER_IRQSAFE is used. One potentially risky scenario was demonstrated in Intel DRM CI trybot, BAT run on machine bat-adlp-6, while working on new IGT subtests syncobj_timeline@stress-* as user space replacements of some problematic test cases of a dma-fence-chain selftest [1]. [117.004338] ================================ [117.004340] WARNING: inconsistent lock state [117.004342] 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 Tainted: G S U [117.004346] -------------------------------- [117.004347] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. [117.004349] swapper/0/0 [HC1[1]:SC1[1]:HE0:SE0] takes: [117.004352] ffff888138f86aa8 ((&fence->timer)){?.-.}-{0:0}, at: __timer_delete_sync+0x4b/0x190 [117.004361] {HARDIRQ-ON-W} state was registered at: [117.004363] lock_acquire+0xc4/0x2e0 [117.004366] call_timer_fn+0x80/0x2a0 [117.004368] __run_timers+0x231/0x310 [117.004370] run_timer_softirq+0x76/0xe0 [117.004372] handle_softirqs+0xd4/0x4d0 [117.004375] __irq_exit_rcu+0x13f/0x160 [117.004377] irq_exit_rcu+0xe/0x20 [117.004379] sysvec_apic_timer_interrupt+0xa0/0xc0 [117.004382] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [117.004385] cpuidle_enter_state+0x12b/0x8a0 [117.004388] cpuidle_enter+0x2e/0x50 [117.004393] call_cpuidle+0x22/0x60 [117.004395] do_idle+0x1fd/0x260 [117.004398] cpu_startup_entry+0x29/0x30 [117.004401] start_secondary+0x12d/0x160 [117.004404] common_startup_64+0x13e/0x141 [117.004407] irq event stamp: 2282669 [117.004409] hardirqs last enabled at (2282668): [] _raw_spin_unlock_irqrestore+0x51/0x80 [117.004414] hardirqs last disabled at (2282669): [] sysvec_irq_work+0x11/0xc0 [117.004419] softirqs last enabled at (2254702): [] __do_softirq+0x10/0x18 [117.004423] softirqs last disabled at (2254725): [] __irq_exit_rcu+0x13f/0x160 [117.004426] other info that might help us debug this: [117.004429] Possible unsafe locking scenario: [117.004432] CPU0 [117.004433] ---- [117.004434] lock((&fence->timer)); [117.004436] [117.004438] lock((&fence->timer)); [117.004440] *** DEADLOCK *** [117.004443] 1 lock held by swapper/0/0: [117.004445] #0: ffffc90000003d50 ((&fence->timer)){?.-.}-{0:0}, at: call_timer_fn+0x7a/0x2a0 [117.004450] stack backtrace: [117.004453] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary) [117.004455] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER [117.004455] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023 [117.004456] Call Trace: [117.004456] [117.004457] dump_stack_lvl+0x91/0xf0 [117.004460] dump_stack+0x10/0x20 [117.004461] print_usage_bug.part.0+0x260/0x360 [117.004463] mark_lock+0x76e/0x9c0 [117.004465] ? register_lock_class+0x48/0x4a0 [117.004467] __lock_acquire+0xbc3/0x2860 [117.004469] lock_acquire+0xc4/0x2e0 [117.004470] ? __timer_delete_sync+0x4b/0x190 [117.004472] ? __timer_delete_sync+0x4b/0x190 [117.004473] __timer_delete_sync+0x68/0x190 [117.004474] ? __timer_delete_sync+0x4b/0x190 [117.004475] timer_delete_sync+0x10/0x20 [117.004476] vgem_fence_release+0x19/0x30 [vgem] [117.004478] dma_fence_release+0xc1/0x3b0 [117.004480] ? dma_fence_release+0xa1/0x3b0 [117.004481] dma_fence_chain_release+0xe7/0x130 [117.004483] dma_fence_release+0xc1/0x3b0 [117.004484] ? _raw_spin_unlock_irqrestore+0x27/0x80 [117.004485] dma_fence_chain_irq_work+0x59/0x80 [117.004487] irq_work_single+0x75/0xa0 [117.004490] irq_work_r ---truncated---
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| linux | — | 6.17.0-19.19 |
| linux-allwinner-5.19 | — | — |
| linux-aws | — | 6.17.0-1009.9 |
| linux-aws-5.0 | — | — |
| linux-aws-5.11 | — | — |
| linux-aws-5.13 | — | — |
| linux-aws-5.15 | — | 5.15.0-1103.110~20.04.1 |
| linux-aws-5.19 | — | — |
| linux-aws-5.3 | — | — |
| linux-aws-5.4 | — | — |
| linux-aws-5.8 | — | — |
| linux-aws-6.14 | — | — |
| linux-aws-6.17 | — | 6.17.0-1009.9~24.04.2 |
| linux-aws-6.2 | — | — |
| linux-aws-6.5 | — | — |
| linux-aws-6.8 | — | 6.8.0-1052.55~22.04.1 |
| linux-aws-fips | — | 6.8.0-1052.55+fips1 |
| linux-aws-hwe | — | — |
| linux-azure | — | 6.17.0-1010.10 |
| linux-azure-4.15 | — | — |
| linux-azure-5.11 | — | — |
| linux-azure-5.13 | — | — |
| linux-azure-5.15 | — | 5.15.0-1110.119~20.04.1 |
| linux-azure-5.19 | — | — |
| linux-azure-5.3 | — | — |
| linux-azure-5.4 | — | — |
| linux-azure-5.8 | — | — |
| linux-azure-6.11 | — | — |
| linux-azure-6.14 | — | — |
| linux-azure-6.17 | — | 6.17.0-1010.10~24.04.1 |
| linux-azure-6.2 | — | — |
| linux-azure-6.5 | — | — |
| linux-azure-6.8 | — | — |
| linux-azure-edge | — | — |
| linux-azure-fde | — | — |
| linux-azure-fde-5.19 | — | — |
| linux-azure-fde-6.14 | — | — |
| linux-azure-fde-6.17 | — | — |
| linux-azure-fde-6.2 | — | — |
| linux-azure-fde-6.8 | — | — |
| linux-azure-fips | — | 6.8.0-1053.59+fips1 |
| linux-azure-nvidia | — | — |
| linux-azure-nvidia-6.14 | — | — |
| linux-bluefield | — | — |
| linux-fips | — | 6.8.0-110.110+fips2 |
| linux-gcp | — | 6.17.0-1009.9 |
| linux-gcp-4.15 | — | — |
| linux-gcp-5.11 | — | — |
| linux-gcp-5.13 | — | — |
| linux-gcp-5.15 | — | 5.15.0-1103.112~20.04.1 |
| linux-gcp-5.19 | — | — |
| linux-gcp-5.3 | — | — |
| linux-gcp-5.4 | — | — |
| linux-gcp-5.8 | — | — |
| linux-gcp-6.11 | — | — |
| linux-gcp-6.14 | — | — |
| linux-gcp-6.17 | — | 6.17.0-1009.9~24.04.3 |
| linux-gcp-6.2 | — | — |
| linux-gcp-6.5 | — | — |
| linux-gcp-6.8 | — | 6.8.0-1054.57~22.04.1 |
| linux-gcp-fips | — | 6.8.0-1054.57+fips1 |
| linux-gke | — | 6.8.0-1050.56 |
| linux-gke-4.15 | — | — |
| linux-gke-5.15 | — | — |
| linux-gke-5.4 | — | — |
| linux-gkeop | — | 6.8.0-1037.40 |
| linux-gkeop-5.15 | — | — |
| linux-gkeop-5.4 | — | — |
| linux-hwe | — | — |
| linux-hwe-5.11 | — | — |
| linux-hwe-5.13 | — | — |
| linux-hwe-5.15 | — | 5.15.0-173.183~20.04.1 |
| linux-hwe-5.19 | — | — |
| linux-hwe-5.4 | — | — |
| linux-hwe-5.8 | — | — |
| linux-hwe-6.11 | — | — |
| linux-hwe-6.14 | — | — |
| linux-hwe-6.17 | — | 6.17.0-19.19~24.04.2 |
| linux-hwe-6.2 | — | — |
| linux-hwe-6.5 | — | — |
| linux-hwe-6.8 | — | 6.8.0-110.110~22.04.1 |
| linux-hwe-edge | — | — |
| linux-ibm | — | 6.8.0-1051.51 |
| linux-ibm-5.15 | — | 5.15.0-1097.100~20.04.1 |
| linux-ibm-5.4 | — | — |
| linux-ibm-6.8 | — | 6.8.0-1051.51~22.04.1 |
| linux-intel-5.13 | — | — |
| linux-intel-iot-realtime | — | 5.15.0-1094.96 |
| linux-intel-iotg | — | 5.15.0-1098.104 |
| linux-intel-iotg-5.15 | — | 5.15.0-1098.104~20.04.1 |
| linux-iot | — | — |
| linux-kvm | — | 5.15.0-1095.100 |
| linux-lowlatency | — | 6.8.0-110.110.1 |
| linux-lowlatency-hwe-5.15 | — | 5.15.0-173.183~20.04.1 |
| linux-lowlatency-hwe-5.19 | — | — |
| linux-lowlatency-hwe-6.11 | — | — |
| linux-lowlatency-hwe-6.2 | — | — |
| linux-lowlatency-hwe-6.5 | — | — |
| linux-lowlatency-hwe-6.8 | — | 6.8.0-110.110.1~22.04.1 |
| linux-nvidia | — | 6.8.0-1051.54 |
| linux-nvidia-6.11 | — | — |
| linux-nvidia-6.17 | — | 6.17.0-1018.18 |
| linux-nvidia-6.2 | — | — |
| linux-nvidia-6.5 | — | — |
| linux-nvidia-6.8 | — | 6.8.0-1051.54~22.04.1 |
| linux-nvidia-lowlatency | — | 6.8.0-1051.54.1 |
| linux-nvidia-tegra | — | 6.8.0-1022.22 |
| linux-nvidia-tegra-5.15 | — | 5.15.0-1055.55~20.04.1 |
| linux-nvidia-tegra-igx | — | 5.15.0-1044.44 |
| linux-oem | — | — |
| linux-oem-5.10 | — | — |
| linux-oem-5.13 | — | — |
| linux-oem-5.14 | — | — |
| linux-oem-5.17 | — | — |
| linux-oem-5.6 | — | — |
| linux-oem-6.0 | — | — |
| linux-oem-6.1 | — | — |
| linux-oem-6.11 | — | — |
| linux-oem-6.14 | — | — |
| linux-oem-6.17 | — | 6.17.0-1017.17 |
| linux-oem-6.5 | — | — |
| linux-oem-6.8 | — | — |
| linux-oracle | — | 6.17.0-1009.9 |
| linux-oracle-5.0 | — | — |
| linux-oracle-5.11 | — | — |
| linux-oracle-5.13 | — | — |
| linux-oracle-5.15 | — | 5.15.0-1100.106~20.04.1 |
| linux-oracle-5.3 | — | — |
| linux-oracle-5.4 | — | — |
| linux-oracle-5.8 | — | — |
| linux-oracle-6.14 | — | — |
| linux-oracle-6.17 | — | 6.17.0-1009.9~24.04.1 |
| linux-oracle-6.5 | — | — |
| linux-oracle-6.8 | — | 6.8.0-1049.50~22.04.1 |
| linux-raspi | — | 6.17.0-1010.10 |
| linux-raspi-5.4 | — | — |
| linux-raspi-realtime | — | 6.8.0-2042.43 |
| linux-raspi2 | — | — |
| linux-realtime | — | 6.17.0-1008.9 |
| linux-realtime-6.14 | — | — |
| linux-realtime-6.17 | — | 6.17.0-1008.9~24.04.1 |
| linux-realtime-6.8 | — | 6.8.1-1047.48~22.04.1 |
| linux-riscv | — | 6.17.0-19.19.1 |
| linux-riscv-5.11 | — | — |
| linux-riscv-5.15 | — | 5.15.0-1097.101~20.04.1 |
| linux-riscv-5.19 | — | — |
| linux-riscv-5.8 | — | — |
| linux-riscv-6.14 | — | — |
| linux-riscv-6.17 | — | 6.17.0-19.19.1~24.04.1 |
| linux-riscv-6.5 | — | — |
| linux-riscv-6.8 | — | 6.8.0-110.110~22.04.1 |
| linux-starfive-5.19 | — | — |
| linux-starfive-6.2 | — | — |
| linux-starfive-6.5 | — | — |
| linux-xilinx | — | 6.8.0-1028.29 |
| linux-xilinx-zynqmp | — | 5.15.0-1067.71 |
References
Similar Threats
- Unknown CGA-23jx-hhcx-m389
- Unknown CGA-2qp7-6757-fmgc
- Unknown CGA-2rj5-jc55-r267
- Unknown CGA-3m96-cwq8-6xmx
- Unknown CGA-3qj9-973w-fh9g
Exploit Protection
Help block exploit attempts
BotEraser is designed to detect and help reduce malicious bot traffic that may target known vulnerabilities on your site.
Try BotEraser Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
