In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fbdev: ssd1307fb: defer I2C transfers from damage callbacks<\/p>\n
The fbdev damage callbacks may run from fbcon while printk has disabled
\npreemption. They currently update the display synchronously, which enters
\nthe sleeping I2C transfer path from atomic context.<\/p>\n
A complete report from an RK3566 system follows:<\/p>\n
[ 258.129004] watchdog: watchdog0: watchdog did not stop!
\n [ 258.129067] BUG: scheduling while atomic: systemd\/1\/0x00000003
\n [ 258.129076] Modules linked in: algif_hash algif_skcipher af_alg bnep
\n binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart
\n fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card
\n motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1
\n ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb
\n brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm
\n snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine
\n v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2
\n spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem
\n videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2
\n stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio
\n stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables
\n x_tables autofs4
\n [ 258.129215] Preemption disabled at:
\n [ 258.129216] [] vprintk_emit+0x11c\/0x340
\n [ 258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G C
\n 6.6.0-rc5-rockchip-rk356x #4
\n [ 258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT)
\n [ 258.129243] Call trace:
\n [ 258.129245] dump_backtrace+0xa0\/0x128
\n [ 258.129252] show_stack+0x20\/0x38
\n [ 258.129256] dump_stack_lvl+0x60\/0xb0
\n [ 258.129265] dump_stack+0x18\/0x28
\n [ 258.129269] __schedule_bug+0xa0\/0xc8
\n [ 258.129274] __schedule+0x9ac\/0xd30
\n [ 258.129279] schedule+0x60\/0x100
\n [ 258.129282] schedule_timeout+0x194\/0x338
\n [ 258.129289] rk3x_i2c_xfer_common.isra.0+0x384\/0x498
\n [ 258.129296] rk3x_i2c_xfer+0x20\/0x60
\n [ 258.129300] __i2c_transfer+0x194\/0x648
\n [ 258.129308] i2c_transfer+0x9c\/0x130
\n [ 258.129313] i2c_transfer_buffer_flags+0x64\/0x98
\n [ 258.129318] ssd1307fb_update_rect+0x42c\/0x560 [ssd1307fb]
\n [ 258.129334] ssd1307fb_defio_imageblit+0x34\/0x50 [ssd1307fb]
\n [ 258.129343] soft_cursor+0x13c\/0x210
\n [ 258.129350] bit_cursor+0x2dc\/0x550
\n [ 258.129354] fbcon_cursor+0xec\/0x108
\n [ 258.129359] hide_cursor+0x44\/0xc8
\n [ 258.129365] vt_console_print+0x398\/0x3b0
\n [ 258.129370] console_flush_all.isra.0+0x17c\/0x410
\n [ 258.129377] console_unlock+0x4c\/0x100
\n [ 258.129382] vprintk_emit+0x1c8\/0x340
\n [ 258.129386] vprintk_default+0x40\/0x58
\n [ 258.129389] vprintk+0xb8\/0xd0
\n [ 258.129392] _printk+0x68\/0x98
\n [ 258.129398] watchdog_release+0x170\/0x230
\n [ 258.129404] __fput+0xbc\/0x288
\n [ 258.129409] __fput_sync+0x58\/0x70
\n [ 258.129413] __arm64_sys_close+0x40\/0x90
\n [ 258.129419] invoke_syscall+0x4c\/0x118
\n [ 258.129426] el0_svc_common.constprop.0+0x48\/0xf0
\n [ 258.129432] do_el0_svc+0x24\/0x38
\n [ 258.129437] el0_svc+0x48\/0x100
\n [ 258.129443] el0t_64_sync_handler+0xc0\/0xc8
\n [ 258.129448] el0t_64_sync+0x190\/0x198
\n [ 258.573087] ————[ cut here ]————
\n [ 258.573098] DEBUG_LOCKS_WARN_ON(val > preempt_count())
\n [ 258.573111] WARNING: CPU: 0 PID: 1 at kernel\/sched\/core.c:5871
\n preempt_count_sub+0x9c\/0x148
\n [ 258.573130] Modules linked in: algif_hash algif_skcipher af_alg bnep
\n binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart
\n fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card
\n motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1
\n ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb
\n brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm
\n snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine
\n v4l2_vp
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fbdev: ssd1307fb: defer I2C transfers from damage callbacks<\/p>\n
The fbdev damage callbacks may run from fbcon while printk has disable<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21520","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}