CVE-2021-47469: spi: Fix deadlock when adding SPI controllers on SPI buses
First published: Wed May 22 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: spi: Fix deadlock when adding SPI controllers on SPI buses Currently we have a global spi_add_lock which we take when adding new devices so that we can check that we're not trying to reuse a chip select that's already controlled. This means that if the SPI device is itself a SPI controller and triggers the instantiation of further SPI devices we trigger a deadlock as we try to register and instantiate those devices while in the process of doing so for the parent controller and hence already holding the global spi_add_lock. Since we only care about concurrency within a single SPI bus move the lock to be per controller, avoiding the deadlock. This can be easily triggered in the case of spi-mux.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | <5.4.286 | |
| Linux Kernel | >=5.5<5.10.230 | |
| Linux Kernel | >=5.11<5.14.15 | |
| Linux Kernel | =5.15-rc1 | |
| Linux Kernel | =5.15-rc2 | |
| Linux Kernel | =5.15-rc3 | |
| Linux Kernel | =5.15-rc4 | |
| Linux Kernel | =5.15-rc5 | |
| debian/linux | <=5.10.223-1<=5.10.234-1 | 6.1.123-1 6.1.128-1 6.12.12-1 6.12.16-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/aa3f3d7bef59583f2d3234173105a27ff61ef8fe
- https://git.kernel.org/stable/c/c8dce228db6f81dbc897a018dfc5c418e917cf64
- https://git.kernel.org/stable/c/722ef19a161ce3fffb3d1b01ce2301c306639bdd
- https://git.kernel.org/stable/c/6098475d4cb48d821bdf453c61118c56e26294f0
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47469
- https://nvd.nist.gov/vuln/detail/CVE-2021-47469
- https://launchpad.net/bugs/cve/CVE-2021-47469
- https://security-tracker.debian.org/tracker/CVE-2021-47469
- https://ubuntu.com/security/CVE-2021-47469
- https://git.kernel.org/linus/6098475d4cb48d821bdf453c61118c56e26294f0
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/weakness
- agent/remedy
- collector/launchpad-cve
- source/Launchpad
- agent/references
- agent/source
- collector/usn-cve
- source/Ubuntu
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/status
- agent/event
- agent/tags
- collector/nvd-api
- package-manager/debian
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.15-rc1
- version/linux kernel/5.15-rc2
- version/linux kernel/5.15-rc3
- version/linux kernel/5.15-rc4
- version/linux kernel/5.15-rc5
- status/rejected