CVE-2023-53866: ASoC: soc-compress: Reposition and add pcm_mutex
In the Linux kernel, the following vulnerability has been resolved:
ASoC: soc-compress: Reposition and add pcmmutex
If paniconwarn is set and compress stream(DPCM) is started, then kernel panic occurred because card->pcmmutex isn't held appropriately. In the following functions, warning were issued at this line "sndsocdpcmmutexassertheld".
static int dpcmbeconnect(struct sndsocpcmruntime fe, struct sndsocpcmruntime be, int stream) { ... sndsocdpcmmutexassertheld(fe); ... }
void dpcmbedisconnect(struct sndsocpcmruntime fe, int stream) { ... sndsocdpcmmutexassertheld(fe); ... }
void sndsocruntimeaction(struct sndsocpcmruntime rtd, int stream, int action) { ... sndsocdpcmmutexassertheld(rtd); ... }
int dpcmdapmstreamevent(struct sndsocpcmruntime fe, int dir, int event) { ... sndsocdpcmmutexassertheld(fe); ... }
These functions are called by soccomprsetparamsfe, soccompropenfe and soccomprfreefe without pcmmutex locking. And this is call stack.
[ 414.527841][ T2179] pc : dpcmprocesspaths+0x5a4/0x750 [ 414.527848][ T2179] lr : dpcmprocesspaths+0x37c/0x750 [ 414.527945][ T2179] Call trace: [ 414.527949][ T2179] dpcmprocesspaths+0x5a4/0x750 [ 414.527955][ T2179] soccompropenfe+0xb0/0x2cc [ 414.527972][ T2179] sndcompropen+0x180/0x248 [ 414.527981][ T2179] sndopen+0x15c/0x194 [ 414.528003][ T2179] chrdevopen+0x1b0/0x220 [ 414.528023][ T2179] dodentryopen+0x30c/0x594 [ 414.528045][ T2179] vfsopen+0x34/0x44 [ 414.528053][ T2179] pathopenat+0x914/0xb08 [ 414.528062][ T2179] dofilpopen+0xc0/0x170 [ 414.528068][ T2179] dosysopenat2+0x94/0x18c [ 414.528076][ T2179] arm64sysopenat+0x78/0xa4 [ 414.528084][ T2179] invokesyscall+0x48/0x10c [ 414.528094][ T2179] el0svccommon+0xbc/0x104 [ 414.528099][ T2179] doel0svc+0x34/0xd8 [ 414.528103][ T2179] el0svc+0x34/0xc4 [ 414.528125][ T2179] el0t64synchandler+0x8c/0xfc [ 414.528133][ T2179] el0t64sync+0x1a0/0x1a4 [ 414.528142][ T2179] Kernel panic - not syncing: paniconwarn set ...
So, I reposition and add pcmmutex to resolve lockdep error.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If panic_on_warn is set and a compress stream (DPCM) is started, the kernel can panic due to a lockdep/lock assertion failure; disable or avoid enabling panic_on_warn for this path unless the mutex ordering/locking fix is applied.
Linux kernel (ASoC soc-compress/DPCM) panic_on_warn = set (enabled) - Configuration
Ensure proper locking by repositioning and adding pcm_mutex so that card->pcm_mutex is held appropriately during the DPCM compress stream lifecycle; specifically cover calls into soc_compr_set_params_fe and soc_compr_open_fe, and ensure the corresponding unlock/free path (soc_compr_free_fe) uses the correct pcm_mutex protection.
Linux kernel (ASoC soc-compress/DPCM) pcm_mutex locking = required
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53866?
CVE-2023-53866 has a high severity rating due to the potential for kernel panic in the Linux kernel.
How do I fix CVE-2023-53866?
To fix CVE-2023-53866, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2023-53866?
CVE-2023-53866 affects various versions of the Linux kernel that utilize the ASoC soc-compress functionality.
What causes the kernel panic in CVE-2023-53866?
The kernel panic in CVE-2023-53866 is caused by improper handling of card->pcm_mutex during the start of a compress stream.
Is there a workaround for CVE-2023-53866?
There is no official workaround for CVE-2023-53866; updating the kernel is recommended to mitigate the vulnerability.