{ "cveId": "CVE-2023-52516", "url": "https://patchblox.com/security/cve/CVE-2023-52516", "summary": "CVE-2023-52516 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-52516, released March 2, 2024. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: dma-debug: don\u0027t call __dma_entry_alloc_check_le...", "description": "In the Linux kernel, the following vulnerability has been resolved: dma-debug: don\u0027t call __dma_entry_alloc_check_leak() under free_entries_lock __dma_entry_alloc_check_leak() calls into printk -\u003E serial console output (qcom geni) and grabs port-\u003Elock under free_entries_lock spin lock, which is a reverse locking dependency chain as qcom_geni IRQ handler can call into dma-debug code and grab free_entries_lock under port-\u003Elock. Move __dma_entry_alloc_check_leak() call out of free_entries_lock scope so that we don\u0027t acquire serial console\u0027s port-\u003Elock under it. Trimmed-down lockdep splat: The existing dependency chain (in reverse order) is: -\u003E #2 (free_entries_lock){-.-.}-{2:2}: _raw_spin_lock_irqsave\u002B0x60/0x80 dma_entry_alloc\u002B0x38/0x110 debug_dma_map_page\u002B0x60/0xf8 dma_map_page_attrs\u002B0x1e0/0x230 dma_map_single_attrs.constprop.0\u002B0x6c/0xc8 geni_se_rx_dma_prep\u002B0x40/0xcc qcom_geni_serial_isr\u002B0x310/0x510 __handle_irq_event_percpu\u002B0x110/0x244 handle_irq_event_percpu\u002B0x20/0x54 handle_irq_event\u002B0x50/0x88 handle_fasteoi_irq\u002B0xa4/0xcc handle_irq_desc\u002B0x28/0x40 generic_handle_domain_irq\u002B0x24/0x30 gic_handle_irq\u002B0xc4/0x148 do_interrupt_handler\u002B0xa4/0xb0 el1_interrupt\u002B0x34/0x64 el1h_64_irq_handler\u002B0x18/0x24 el1h_64_irq\u002B0x64/0x68 arch_local_irq_enable\u002B0x4/0x8 ____do_softirq\u002B0x18/0x24 ... -\u003E #1 (\u0026port_lock_key){-.-.}-{2:2}: _raw_spin_lock_irqsave\u002B0x60/0x80 qcom_geni_serial_console_write\u002B0x184/0x1dc console_flush_all\u002B0x344/0x454 console_unlock\u002B0x94/0xf0 vprintk_emit\u002B0x238/0x24c vprintk_default\u002B0x3c/0x48 vprintk\u002B0xb4/0xbc _printk\u002B0x68/0x90 register_console\u002B0x230/0x38c uart_add_one_port\u002B0x338/0x494 qcom_geni_serial_probe\u002B0x390/0x424 platform_probe\u002B0x70/0xc0 really_probe\u002B0x148/0x280 __driver_probe_device\u002B0xfc/0x114 driver_probe_device\u002B0x44/0x100 __device_attach_driver\u002B0x64/0xdc bus_for_each_drv\u002B0xb0/0xd8 __device_attach\u002B0xe4/0x140 device_initial_probe\u002B0x1c/0x28 bus_probe_device\u002B0x44/0xb0 device_add\u002B0x538/0x668 of_device_add\u002B0x44/0x50 of_platform_device_create_pdata\u002B0x94/0xc8 of_platform_bus_create\u002B0x270/0x304 of_platform_populate\u002B0xac/0xc4 devm_of_platform_populate\u002B0x60/0xac geni_se_probe\u002B0x154/0x160 platform_probe\u002B0x70/0xc0 ... -\u003E #0 (console_owner){-...}-{0:0}: __lock_acquire\u002B0xdf8/0x109c lock_acquire\u002B0x234/0x284 console_flush_all\u002B0x330/0x454 console_unlock\u002B0x94/0xf0 vprintk_emit\u002B0x238/0x24c vprintk_default\u002B0x3c/0x48 vprintk\u002B0xb4/0xbc _printk\u002B0x68/0x90 dma_entry_alloc\u002B0xb4/0x110 debug_dma_map_sg\u002B0xdc/0x2f8 __dma_map_sg_attrs\u002B0xac/0xe4 dma_map_sgtable\u002B0x30/0x4c get_pages\u002B0x1d4/0x1e4 [msm] msm_gem_pin_pages_locked\u002B0x38/0xac [msm] msm_gem_pin_vma_locked\u002B0x58/0x88 [msm] msm_ioctl_gem_submit\u002B0xde4/0x13ac [msm] drm_ioctl_kernel\u002B0xe0/0x15c drm_ioctl\u002B0x2e8/0x3f4 vfs_ioctl\u002B0x30/0x50 ... Chain exists of: console_owner --\u003E \u0026port_lock_key --\u003E free_entries_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(free_entries_lock); lock(\u0026port_lock_key); lock(free_entries_lock); lock(console_owner); *** DEADLOCK *** Call trace: dump_backtrace\u002B0xb4/0xf0 show_stack\u002B0x20/0x30 dump_stack_lvl\u002B0x60/0x84 dump_stack\u002B0x18/0x24 print_circular_bug\u002B0x1cc/0x234 check_noncircular\u002B0x78/0xac __lock_acquire\u002B0xdf8/0x109c lock_acquire\u002B0x234/0x284 console_flush_all\u002B0x330/0x454 consol ---truncated---", "published": "2024-03-02T22:15:47Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00171, "epssPercentile": 0.06537, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "6.1.64-1", "fix": "DEBIAN-CVE-2023-52516", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52516", "released": "2024-03-02T22:15:47Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.5.6-1", "fix": "DEBIAN-CVE-2023-52516", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52516", "released": "2024-03-02T22:15:47Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.5.6-1", "fix": "DEBIAN-CVE-2023-52516", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52516", "released": "2024-03-02T22:15:47Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T07:25:28Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }