Vulnerability-Lookup

GHSA-752V-R57R-J98P

Vulnerability from github – Published: 2025-06-18 12:30 – Updated: 2025-11-13 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pci: Fix get_phb_number() locking

The recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP warning on some systems:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by swapper/1: #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at: pcibios_alloc_controller+0x64/0x220 Preemption disabled at: [<00000000>] 0x0 CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1 Call Trace: [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable) [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8 [d101dcd0] [c0d3e634] __mutex_lock+0x6c/0x6ec [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4 [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220 [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784 [d101de50] [c140852c] discover_phbs+0x30/0x4c [d101de60] [c0007fd4] do_one_initcall+0x94/0x344 [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c [d101df10] [c00086e0] kernel_init+0x34/0x160 [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64

This is because pcibios_alloc_controller() holds hose_spinlock but of_alias_get_id() takes of_mutex which can sleep.

The hose_spinlock protects the phb_bitmap, and also the hose_list, but it doesn't need to be held while get_phb_number() calls the OF routines, because those are only looking up information in the device tree.

So fix it by having get_phb_number() take the hose_spinlock itself, only where required, and then dropping the lock before returning. pcibios_alloc_controller() then needs to take the lock again before the list_add() but that's safe, the order of the list is not important.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-50045"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-667"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-18T11:15:33Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pci: Fix get_phb_number() locking\n\nThe recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP\nwarning on some systems:\n\n  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper\n  preempt_count: 1, expected: 0\n  RCU nest depth: 0, expected: 0\n  1 lock held by swapper/1:\n   #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at: pcibios_alloc_controller+0x64/0x220\n  Preemption disabled at:\n  [\u003c00000000\u003e] 0x0\n  CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1\n  Call Trace:\n  [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable)\n  [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8\n  [d101dcd0] [c0d3e634] __mutex_lock+0x6c/0x6ec\n  [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4\n  [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220\n  [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784\n  [d101de50] [c140852c] discover_phbs+0x30/0x4c\n  [d101de60] [c0007fd4] do_one_initcall+0x94/0x344\n  [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c\n  [d101df10] [c00086e0] kernel_init+0x34/0x160\n  [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64\n\nThis is because pcibios_alloc_controller() holds hose_spinlock but\nof_alias_get_id() takes of_mutex which can sleep.\n\nThe hose_spinlock protects the phb_bitmap, and also the hose_list, but\nit doesn\u0027t need to be held while get_phb_number() calls the OF routines,\nbecause those are only looking up information in the device tree.\n\nSo fix it by having get_phb_number() take the hose_spinlock itself, only\nwhere required, and then dropping the lock before returning.\npcibios_alloc_controller() then needs to take the lock again before the\nlist_add() but that\u0027s safe, the order of the list is not important.",
  "id": "GHSA-752v-r57r-j98p",
  "modified": "2025-11-13T21:31:18Z",
  "published": "2025-06-18T12:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50045"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1d9e75c3d8cdf7c96a94cb77450d4ee070279e6a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5db5ce0f1963c6c8275719a80cb65e9c98d32726"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6f75057c21eab12c6ccb7f06f859641a6edfab99"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8d48562a2729742f767b0fdd994d6b2a56a49c63"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/90f195c01a2e8d8da6281791617e21109719c981"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a868f771ee41c97a25a04b8c632a7f06689b307b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ccb0a42d3f40c436295e0fef57ab613ae5b925a4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-50045 (GCVE-0-2022-50045)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:01 – Updated: 2026-05-23 15:23

Title

powerpc/pci: Fix get_phb_number() locking

Summary

In the Linux kernel, the following vulnerability has been resolved: powerpc/pci: Fix get_phb_number() locking The recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP warning on some systems: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by swapper/1: #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at: pcibios_alloc_controller+0x64/0x220 Preemption disabled at: [<00000000>] 0x0 CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1 Call Trace: [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable) [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8 [d101dcd0] [c0d3e634] __mutex_lock+0x6c/0x6ec [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4 [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220 [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784 [d101de50] [c140852c] discover_phbs+0x30/0x4c [d101de60] [c0007fd4] do_one_initcall+0x94/0x344 [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c [d101df10] [c00086e0] kernel_init+0x34/0x160 [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64 This is because pcibios_alloc_controller() holds hose_spinlock but of_alias_get_id() takes of_mutex which can sleep. The hose_spinlock protects the phb_bitmap, and also the hose_list, but it doesn't need to be held while get_phb_number() calls the OF routines, because those are only looking up information in the device tree. So fix it by having get_phb_number() take the hose_spinlock itself, only where required, and then dropping the lock before returning. pcibios_alloc_controller() then needs to take the lock again before the list_add() but that's safe, the order of the list is not important.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/6f75057c21eab12c6…
https://git.kernel.org/stable/c/5db5ce0f1963c6c82…
https://git.kernel.org/stable/c/ccb0a42d3f40c4362…
https://git.kernel.org/stable/c/a868f771ee41c97a2…
https://git.kernel.org/stable/c/1d9e75c3d8cdf7c96…
https://git.kernel.org/stable/c/90f195c01a2e8d8da…
https://git.kernel.org/stable/c/8d48562a2729742f7…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a79e4395619c926ea7e828b2023c0fbe2776385b , < 6f75057c21eab12c6ccb7f06f859641a6edfab99 (git) Affected: 205826dcac3271ab04fb97d66f1b4f8219723259 , < 5db5ce0f1963c6c8275719a80cb65e9c98d32726 (git) Affected: 3ec50b8a0128359ff4ad4061a75c3322d0ab6ac9 , < ccb0a42d3f40c436295e0fef57ab613ae5b925a4 (git) Affected: 47a8fe1b154aa6d836582365b1c70684af8597e4 , < a868f771ee41c97a25a04b8c632a7f06689b307b (git) Affected: ef0f4eeaba2463a77ac5a4e42c30717deb3c7b62 , < 1d9e75c3d8cdf7c96a94cb77450d4ee070279e6a (git) Affected: f35c7f506fb96a23a1961c7314c5931ec8bc473e , < 90f195c01a2e8d8da6281791617e21109719c981 (git) Affected: 0fe1e96fef0a5c53b4c0d1500d356f3906000f81 , < 8d48562a2729742f767b0fdd994d6b2a56a49c63 (git) Affected: e0274da3ac318296fed503422ccda98ce67e99cb (git) Affected: 5.18.18 , < 5.19 (semver)
Linux	Linux	Affected: 5.10.137 , < 5.10.138 (semver) Affected: 5.15.61 , < 5.15.63 (semver) Affected: 5.19.2 , < 5.19.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/pci-common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f75057c21eab12c6ccb7f06f859641a6edfab99",
              "status": "affected",
              "version": "a79e4395619c926ea7e828b2023c0fbe2776385b",
              "versionType": "git"
            },
            {
              "lessThan": "5db5ce0f1963c6c8275719a80cb65e9c98d32726",
              "status": "affected",
              "version": "205826dcac3271ab04fb97d66f1b4f8219723259",
              "versionType": "git"
            },
            {
              "lessThan": "ccb0a42d3f40c436295e0fef57ab613ae5b925a4",
              "status": "affected",
              "version": "3ec50b8a0128359ff4ad4061a75c3322d0ab6ac9",
              "versionType": "git"
            },
            {
              "lessThan": "a868f771ee41c97a25a04b8c632a7f06689b307b",
              "status": "affected",
              "version": "47a8fe1b154aa6d836582365b1c70684af8597e4",
              "versionType": "git"
            },
            {
              "lessThan": "1d9e75c3d8cdf7c96a94cb77450d4ee070279e6a",
              "status": "affected",
              "version": "ef0f4eeaba2463a77ac5a4e42c30717deb3c7b62",
              "versionType": "git"
            },
            {
              "lessThan": "90f195c01a2e8d8da6281791617e21109719c981",
              "status": "affected",
              "version": "f35c7f506fb96a23a1961c7314c5931ec8bc473e",
              "versionType": "git"
            },
            {
              "lessThan": "8d48562a2729742f767b0fdd994d6b2a56a49c63",
              "status": "affected",
              "version": "0fe1e96fef0a5c53b4c0d1500d356f3906000f81",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e0274da3ac318296fed503422ccda98ce67e99cb",
              "versionType": "git"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/pci-common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.10.138",
              "status": "affected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.63",
              "status": "affected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19.4",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.138",
                  "versionStartIncluding": "5.10.137",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.63",
                  "versionStartIncluding": "5.15.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.4",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pci: Fix get_phb_number() locking\n\nThe recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP\nwarning on some systems:\n\n  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper\n  preempt_count: 1, expected: 0\n  RCU nest depth: 0, expected: 0\n  1 lock held by swapper/1:\n   #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at: pcibios_alloc_controller+0x64/0x220\n  Preemption disabled at:\n  [\u003c00000000\u003e] 0x0\n  CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1\n  Call Trace:\n  [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable)\n  [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8\n  [d101dcd0] [c0d3e634] __mutex_lock+0x6c/0x6ec\n  [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4\n  [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220\n  [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784\n  [d101de50] [c140852c] discover_phbs+0x30/0x4c\n  [d101de60] [c0007fd4] do_one_initcall+0x94/0x344\n  [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c\n  [d101df10] [c00086e0] kernel_init+0x34/0x160\n  [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64\n\nThis is because pcibios_alloc_controller() holds hose_spinlock but\nof_alias_get_id() takes of_mutex which can sleep.\n\nThe hose_spinlock protects the phb_bitmap, and also the hose_list, but\nit doesn\u0027t need to be held while get_phb_number() calls the OF routines,\nbecause those are only looking up information in the device tree.\n\nSo fix it by having get_phb_number() take the hose_spinlock itself, only\nwhere required, and then dropping the lock before returning.\npcibios_alloc_controller() then needs to take the lock again before the\nlist_add() but that\u0027s safe, the order of the list is not important."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:23:36.551Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f75057c21eab12c6ccb7f06f859641a6edfab99"
        },
        {
          "url": "https://git.kernel.org/stable/c/5db5ce0f1963c6c8275719a80cb65e9c98d32726"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccb0a42d3f40c436295e0fef57ab613ae5b925a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a868f771ee41c97a25a04b8c632a7f06689b307b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d9e75c3d8cdf7c96a94cb77450d4ee070279e6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/90f195c01a2e8d8da6281791617e21109719c981"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d48562a2729742f767b0fdd994d6b2a56a49c63"
        }
      ],
      "title": "powerpc/pci: Fix get_phb_number() locking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50045",
    "datePublished": "2025-06-18T11:01:46.233Z",
    "dateReserved": "2025-06-18T10:57:27.401Z",
    "dateUpdated": "2026-05-23T15:23:36.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.