CVE-2021-47449

ice: fix locking for Tx timestamp tracking flush

High · published May 22, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ice: fix locking for Tx timestamp tracking flush

Commit 4dd0d5c33c3e ("ice: add lock around Tx timestamp tracker flush")

added a lock around the Tx timestamp tracker flow which is used to

cleanup any left over SKBs and prepare for device removal.

This lock is problematic because it is being held around a call to

ice_clear_phy_tstamp. The clear function takes a mutex to send a PHY

write command to firmware. This could lead to a deadlock if the mutex

actually sleeps, and causes the following warning on a kernel with

preemption debugging enabled:

[ 715.419426] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:573

[ 715.427900] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3100, name: rmmod

[ 715.435652] INFO: lockdep is turned off.

[ 715.439591] Preemption disabled at:

[ 715.439594] [<0000000000000000>] 0x0

[ 715.446678] CPU: 52 PID: 3100 Comm: rmmod Tainted: G W OE 5.15.0-rc4+ #42 bdd7ec3018e725f159ca0d372ce8c2c0e784891c

[ 715.458058] Hardware name: Intel Corporation S2600STQ/S2600STQ, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020

[ 715.468483] Call Trace:

[ 715.470940] dump_stack_lvl+0x6a/0x9a

[ 715.474613] ___might_sleep.cold+0x224/0x26a

[ 715.478895] __mutex_lock+0xb3/0x1440

[ 715.482569] ? stack_depot_save+0x378/0x500

[ 715.486763] ? ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.494979] ? kfree+0xc1/0x520

[ 715.498128] ? mutex_lock_io_nested+0x12a0/0x12a0

[ 715.502837] ? kasan_set_free_info+0x20/0x30

[ 715.507110] ? __kasan_slab_free+0x10b/0x140

[ 715.511385] ? slab_free_freelist_hook+0xc7/0x220

[ 715.516092] ? kfree+0xc1/0x520

[ 715.519235] ? ice_deinit_lag+0x16c/0x220 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.527359] ? ice_remove+0x1cf/0x6a0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.535133] ? pci_device_remove+0xab/0x1d0

[ 715.539318] ? __device_release_driver+0x35b/0x690

[ 715.544110] ? driver_detach+0x214/0x2f0

[ 715.548035] ? bus_remove_driver+0x11d/0x2f0

[ 715.552309] ? pci_unregister_driver+0x26/0x250

[ 715.556840] ? ice_module_exit+0xc/0x2f [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.564799] ? __do_sys_delete_module.constprop.0+0x2d8/0x4e0

[ 715.570554] ? do_syscall_64+0x3b/0x90

[ 715.574303] ? entry_SYSCALL_64_after_hwframe+0x44/0xae

[ 715.579529] ? start_flush_work+0x542/0x8f0

[ 715.583719] ? ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.591923] ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.599960] ? wait_for_completion_io+0x250/0x250

[ 715.604662] ? lock_acquire+0x196/0x200

[ 715.608504] ? do_raw_spin_trylock+0xa5/0x160

[ 715.612864] ice_sbq_rw_reg+0x1e6/0x2f0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.620813] ? ice_reset+0x130/0x130 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.628497] ? __debug_check_no_obj_freed+0x1e8/0x3c0

[ 715.633550] ? trace_hardirqs_on+0x1c/0x130

[ 715.637748] ice_write_phy_reg_e810+0x70/0xf0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.646220] ? do_raw_spin_trylock+0xa5/0x160

[ 715.650581] ? ice_ptp_release+0x910/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.658797] ? ice_ptp_release+0x255/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.667013] ice_clear_phy_tstamp+0x2c/0x110 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.675403] ice_ptp_release+0x408/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.683440] ice_remove+0x560/0x6a0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]

[ 715.691037] ? _raw_spin_unlock_irqrestore+0x46/0x73

[ 715.696005] pci_device_remove+0xab/0x1d0

[ 715.700018] __device_release_driver+0x35b/0x690

[ 715.704637] driver_detach+0x214/0x2f0

[ 715.708389] bus_remove_driver+0x11d/0x2f0

[ 715.712489] pci_unregister_driver+0x26/0x250

[ 71

---truncated---

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00199 · 9.2th percentile
Published
2024-05-22T06:19Z
EPSS history
Timeline
  • 22 MAY 06:19Z
    ice: fix locking for Tx timestamp tracking flush
    cvelistv5