https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 08:41:09 +0000 https://vulnerability.circl.lu/vuln/cve-2024-57889 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking</p> <p>If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen:</p> <p>BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ... preempt_count: 1, expected: 0 ... Call Trace: ... __might_resched+0x104/0x10e __might_sleep+0x3e/0x62 mutex_lock+0x20/0x4c regmap_lock_mutex+0x10/0x18 regmap_update_bits_base+0x2c/0x66 mcp23s08_irq_set_type+0x1ae/0x1d6 __irq_set_trigger+0x56/0x172 __setup_irq+0x1e6/0x646 request_threaded_irq+0xb6/0x160 ...</p> <p>We observed the problem while experimenting with a touchscreen driver which used MCP23017 IO expander (I2C).</p> <p>The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from concurrent accesses, which is the default for regmaps without .fast_io, .disable_locking, etc.</p> <p>mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter locks the mutex.</p> <p>However, __setup_irq() locks desc-&gt;lock spinlock before calling these functions. As a result, the system tries to lock the mutex whole holding the spinlock.</p> <p>It seems, the internal regmap locks are not needed in this driver at all. mcp-&gt;lock seems to protect the regmap from concurrent accesses already, except, probably, in mcp_pinconf_get/set.</p> <p>mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under c…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking</p> <p>If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen:</p> <p>BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ... preempt_count: 1, expected: 0 ... Call Trace: ... __might_resched+0x104/0x10e __might_sleep+0x3e/0x62 mutex_lock+0x20/0x4c regmap_lock_mutex+0x10/0x18 regmap_update_bits_base+0x2c/0x66 mcp23s08_irq_set_type+0x1ae/0x1d6 __irq_set_trigger+0x56/0x172 __setup_irq+0x1e6/0x646 request_threaded_irq+0xb6/0x160 ...</p> <p>We observed the problem while experimenting with a touchscreen driver which used MCP23017 IO expander (I2C).</p> <p>The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from concurrent accesses, which is the default for regmaps without .fast_io, .disable_locking, etc.</p> <p>mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter locks the mutex.</p> <p>However, __setup_irq() locks desc-&gt;lock spinlock before calling these functions. As a result, the system tries to lock the mutex whole holding the spinlock.</p> <p>It seems, the internal regmap locks are not needed in this driver at all. mcp-&gt;lock seems to protect the regmap from concurrent accesses already, except, probably, in mcp_pinconf_get/set.</p> <p>mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under c…</p> https://vulnerability.circl.lu/vuln/cve-2024-57889