Message-ID: <2025120937-CVE-2022-50652-b7be@gregkh>
Date: Tue,  9 Dec 2025 09:01:53 +0900
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50652: uio: uio_dmem_genirq: Fix missing unlock in irq configuration

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

uio: uio_dmem_genirq: Fix missing unlock in irq configuration

Commit b74351287d4b ("uio: fix a sleep-in-atomic-context bug in
uio_dmem_genirq_irqcontrol()") started calling disable_irq() without
holding the spinlock because it can sleep. However, that fix introduced
another bug: if interrupt is already disabled and a new disable request
comes in, then the spinlock is not unlocked:

root@...alhost:~# printf '\x00\x00\x00\x00' > /dev/uio0
root@...alhost:~# printf '\x00\x00\x00\x00' > /dev/uio0
root@...alhost:~# [   14.851538] BUG: scheduling while atomic: bash/223/0x00000002
[   14.851991] Modules linked in: uio_dmem_genirq uio myfpga(OE) bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper drm snd_pcm ppdev joydev psmouse snd_timer snd e1000fb_sys_fops syscopyarea parport sysfillrect soundcore sysimgblt input_leds pcspkr i2c_piix4 serio_raw floppy evbug qemu_fw_cfg mac_hid pata_acpi ip_tables x_tables autofs4 [last unloaded: parport_pc]
[   14.854206] CPU: 0 PID: 223 Comm: bash Tainted: G           OE      6.0.0-rc7 #21
[   14.854786] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
[   14.855664] Call Trace:
[   14.855861]  <TASK>
[   14.856025]  dump_stack_lvl+0x4d/0x67
[   14.856325]  dump_stack+0x14/0x1a
[   14.856583]  __schedule_bug.cold+0x4b/0x5c
[   14.856915]  __schedule+0xe81/0x13d0
[   14.857199]  ? idr_find+0x13/0x20
[   14.857456]  ? get_work_pool+0x2d/0x50
[   14.857756]  ? __flush_work+0x233/0x280
[   14.858068]  ? __schedule+0xa95/0x13d0
[   14.858307]  ? idr_find+0x13/0x20
[   14.858519]  ? get_work_pool+0x2d/0x50
[   14.858798]  schedule+0x6c/0x100
[   14.859009]  schedule_hrtimeout_range_clock+0xff/0x110
[   14.859335]  ? tty_write_room+0x1f/0x30
[   14.859598]  ? n_tty_poll+0x1ec/0x220
[   14.859830]  ? tty_ldisc_deref+0x1a/0x20
[   14.860090]  schedule_hrtimeout_range+0x17/0x20
[   14.860373]  do_select+0x596/0x840
[   14.860627]  ? __kernel_text_address+0x16/0x50
[   14.860954]  ? poll_freewait+0xb0/0xb0
[   14.861235]  ? poll_freewait+0xb0/0xb0
[   14.861517]  ? rpm_resume+0x49d/0x780
[   14.861798]  ? common_interrupt+0x59/0xa0
[   14.862127]  ? asm_common_interrupt+0x2b/0x40
[   14.862511]  ? __uart_start.isra.0+0x61/0x70
[   14.862902]  ? __check_object_size+0x61/0x280
[   14.863255]  core_sys_select+0x1c6/0x400
[   14.863575]  ? vfs_write+0x1c9/0x3d0
[   14.863853]  ? vfs_write+0x1c9/0x3d0
[   14.864121]  ? _copy_from_user+0x45/0x70
[   14.864526]  do_pselect.constprop.0+0xb3/0xf0
[   14.864893]  ? do_syscall_64+0x6d/0x90
[   14.865228]  ? do_syscall_64+0x6d/0x90
[   14.865556]  __x64_sys_pselect6+0x76/0xa0
[   14.865906]  do_syscall_64+0x60/0x90
[   14.866214]  ? syscall_exit_to_user_mode+0x2a/0x50
[   14.866640]  ? do_syscall_64+0x6d/0x90
[   14.866972]  ? do_syscall_64+0x6d/0x90
[   14.867286]  ? do_syscall_64+0x6d/0x90
[   14.867626]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...] stripped
[   14.872959]  </TASK>

('myfpga' is a simple 'uio_dmem_genirq' driver I wrote to test this)

The implementation of "uio_dmem_genirq" was based on "uio_pdrv_genirq" and
it is used in a similar manner to the "uio_pdrv_genirq" driver with respect
to interrupt configuration and handling. At the time "uio_dmem_genirq" was
introduced, both had the same implementation of the 'uio_info' handlers
irqcontrol() and handler(). Then commit 34cb27528398 ("UIO: Fix concurrency
issue"), which was only applied to "uio_pdrv_genirq", ended up making them
a little different. That commit, among other things, changed disable_irq()
to disable_irq_nosync() in the implementation of irqcontrol(). The
motivation there was to avoid a deadlock between irqcontrol() and
handler(), since it added a spinlock in the irq handler, and disable_irq()
waits for the completion of the irq handler.

By changing disable_irq() to disable_irq_nosync() in irqcontrol(), we also
avoid the sleeping-while-atomic bug that commit b74351287d4b ("uio: fix a
sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()") was trying to
fix. Thus, this fixes the missing unlock in irqcontrol() by importing the
implementation of irqcontrol() handler from the "uio_pdrv_genirq" driver.
In the end, it reverts commit b74351287d4b ("uio: fix a
sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()") and change
disable_irq() to disable_irq_nosync().

It is worth noting that this still does not address the concurrency issue
fixed by commit 34cb27528398 ("UIO: Fix concurrency issue"). It will be
addressed separately in the next commits.

Split out from commit 34cb27528398 ("UIO: Fix concurrency issue").

The Linux kernel CVE team has assigned CVE-2022-50652 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.9.215 with commit b77fa964ecb1d72a671234f5bea95b41f77c233a and fixed in 4.9.337 with commit 9977cb7af5a8f4738198b020436e2e56c5cd721e
	Issue introduced in 4.14.172 with commit 0151b03f43f2d295a6949454434074b34a262e06 and fixed in 4.14.303 with commit a323d24a0183be730d2398b11b3a91e5c2e222a0
	Issue introduced in 4.19.106 with commit ea6b7b1d58790ffb36bace723f6e62a1c8595c77 and fixed in 4.19.270 with commit ac5585bb06a2e82177269bee93e59887ce591106
	Issue introduced in 5.4.22 with commit 750a95d63746458e86c6d92dfad48a05c64d0ecd and fixed in 5.4.229 with commit eca77a25a7cb3201738f4b55b9b8fa1089d7d002
	Issue introduced in 5.6 with commit b74351287d4bd90636c3f48bc188c2f53824c2d4 and fixed in 5.10.163 with commit 9bf7a0b2b15cd12e15f7858072bd89933746de67
	Issue introduced in 5.6 with commit b74351287d4bd90636c3f48bc188c2f53824c2d4 and fixed in 5.15.86 with commit 79a4bdb6b9920134af1a4738a1fa36a0438cd905
	Issue introduced in 5.6 with commit b74351287d4bd90636c3f48bc188c2f53824c2d4 and fixed in 6.0.16 with commit 030b6c7bb1e4edebaee2b1e48fbcc9cd5998d51d
	Issue introduced in 5.6 with commit b74351287d4bd90636c3f48bc188c2f53824c2d4 and fixed in 6.1.2 with commit ee180e867ce4b2f744799247b81050b3e5dd62cd
	Issue introduced in 5.6 with commit b74351287d4bd90636c3f48bc188c2f53824c2d4 and fixed in 6.2 with commit 9de255c461d1b3f0242b3ad1450c3323a3e00b34
	Issue introduced in 4.4.215 with commit 4a117a1c581623d04bf09aa7455d8e7b66e8bb85
	Issue introduced in 5.5.6 with commit 1d52cd8b52876145b0f6344be95fc750e30d9ecb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50652
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/uio/uio_dmem_genirq.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9977cb7af5a8f4738198b020436e2e56c5cd721e
	https://git.kernel.org/stable/c/a323d24a0183be730d2398b11b3a91e5c2e222a0
	https://git.kernel.org/stable/c/ac5585bb06a2e82177269bee93e59887ce591106
	https://git.kernel.org/stable/c/eca77a25a7cb3201738f4b55b9b8fa1089d7d002
	https://git.kernel.org/stable/c/9bf7a0b2b15cd12e15f7858072bd89933746de67
	https://git.kernel.org/stable/c/79a4bdb6b9920134af1a4738a1fa36a0438cd905
	https://git.kernel.org/stable/c/030b6c7bb1e4edebaee2b1e48fbcc9cd5998d51d
	https://git.kernel.org/stable/c/ee180e867ce4b2f744799247b81050b3e5dd62cd
	https://git.kernel.org/stable/c/9de255c461d1b3f0242b3ad1450c3323a3e00b34

Powered by blists - more mailing lists