Description
In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() There is a deadlock in rtllib_beacons_stop(), which is shown below: (Thread 1) | (Thread 2) | rtllib_send_beacon() rtllib_beacons_stop() | mod_timer() spin_lock_irqsave() //(1) | (wait a time) ... | rtllib_send_beacon_cb() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold ieee->beacon_lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need ieee->beacon_lock in position (2) of thread 2. As a result, rtllib_beacons_stop() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
94a799425eee8225a1e3fbe5f473d2ef04002577 to < 4681129fda9e8555392eaaadb239ec6a6e2b3e12affected94a799425eee8225a1e3fbe5f473d2ef04002577 to < 381045dc64d23a2229c47c5524c06bfc33d34446affected94a799425eee8225a1e3fbe5f473d2ef04002577 to < 08bacf871c019163ccd1389d0bc957a43324967aaffected94a799425eee8225a1e3fbe5f473d2ef04002577 to < 64b05fa212c7e4d057676e8b7e7120c6eb2f615baffected94a799425eee8225a1e3fbe5f473d2ef04002577 to < 0f69d7d5e918aa43423d86bd17ddb11b1b5e8adaaffected94a799425eee8225a1e3fbe5f473d2ef04002577 to < fef451f0fbbe85dbd2962b18379d02e2965610dbaffected94a799425eee8225a1e3fbe5f473d2ef04002577 to < 46c861009bf437a18417df24cea0d181741b7d72affected94a799425eee8225a1e3fbe5f473d2ef04002577 to < ffd4c4d5293e4985092ea45ba21cad9326e2e434affected94a799425eee8225a1e3fbe5f473d2ef04002577 to < 9b6bdbd9337de3917945847bde262a34a87a6303affected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected4.9.318 to ≤ 4.9.*unaffected4.14.283 to ≤ 4.14.*unaffected4.19.247 to ≤ 4.19.*unaffected5.4.198 to ≤ 5.4.*unaffected5.10.122 to ≤ 5.10.*unaffected5.15.47 to ≤ 5.15.*unaffected5.17.15 to ≤ 5.17.*unaffected5.18.4 to ≤ 5.18.*unaffected5.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4681129fda9e8555392eaaadb239ec6a6e2b3e12 ↗
- https://git.kernel.org/stable/c/381045dc64d23a2229c47c5524c06bfc33d34446 ↗
- https://git.kernel.org/stable/c/08bacf871c019163ccd1389d0bc957a43324967a ↗
- https://git.kernel.org/stable/c/64b05fa212c7e4d057676e8b7e7120c6eb2f615b ↗
- https://git.kernel.org/stable/c/0f69d7d5e918aa43423d86bd17ddb11b1b5e8ada ↗
- https://git.kernel.org/stable/c/fef451f0fbbe85dbd2962b18379d02e2965610db ↗
- https://git.kernel.org/stable/c/46c861009bf437a18417df24cea0d181741b7d72 ↗
- https://git.kernel.org/stable/c/ffd4c4d5293e4985092ea45ba21cad9326e2e434 ↗
- https://git.kernel.org/stable/c/9b6bdbd9337de3917945847bde262a34a87a6303 ↗