CVE-2021-47271 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
usb: cdnsp: Fix deadlock issue in cdnsp_thread_irq_handler
Patch fixes the following critical issue caused by deadlock which has been detected during testing NCM class:
smp: csd: Detected non-responsive CSD lock (#1) on CPU#0 smp: csd: CSD lock (#1) unresponsive. .... RIP: 0010:native_queued_spin_lock_slowpath+0x61/0x1d0 RSP: 0018:ffffbc494011cde0 EFLAGS: 00000002 RAX: 0000000000000101 RBX: ffff9ee8116b4a68 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ee8116b4658 RBP: ffffbc494011cde0 R08: 0000000000000001 R09: 0000000000000000 R10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658 R13: ffff9ee8116b4670 R14: 0000000000000246 R15: ffff9ee8116b4658 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7bcc41a830 CR3: 000000007a612003 CR4: 00000000001706e0 Call Trace: do_raw_spin_lock+0xc0/0xd0 _raw_spin_lock_irqsave+0x95/0xa0 cdnsp_gadget_ep_queue.cold+0x88/0x107 [cdnsp_udc_pci]
usb_ep_queue+0x35/0x110 eth_start_xmit+0x220/0x3d0 [u_ether]
ncm_tx_timeout+0x34/0x40 [usb_f_ncm]
? ncm_free_inst+0x50/0x50 [usb_f_ncm]
__hrtimer_run_queues+0xac/0x440 hrtimer_run_softirq+0x8c/0xb0 __do_softirq+0xcf/0x428 asm_call_irq_on_stack+0x12/0x20 do_softirq_own_stack+0x61/0x70 irq_exit_rcu+0xc1/0xd0 sysvec_apic_timer_interrupt+0x52/0xb0 asm_sysvec_apic_timer_interrupt+0x12/0x20 RIP: 0010:do_raw_spin_trylock+0x18/0x40 RSP: 0018:ffffbc494138bda8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff9ee8116b4658 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9ee8116b4658 RBP: ffffbc494138bda8 R08: 0000000000000001 R09: 0000000000000000 R10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658 R13: ffff9ee8116b4670 R14: ffff9ee7b5c73d80 R15: ffff9ee8116b4000 _raw_spin_lock+0x3d/0x70 ? cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci]
cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci]
? cdnsp_remove_request+0x1f0/0x1f0 [cdnsp_udc_pci]
? cdnsp_thread_irq_handler+0x5/0xa0 [cdnsp_udc_pci]
? irq_thread+0xa0/0x1c0 irq_thread_fn+0x28/0x60 irq_thread+0x105/0x1c0 ? __kthread_parkme+0x42/0x90 ? irq_forced_thread_fn+0x90/0x90 ? wake_threads_waitq+0x30/0x30 ? irq_thread_check_affinity+0xe0/0xe0 kthread+0x12a/0x160 ? kthread_park+0x90/0x90 ret_from_fork+0x22/0x30
The root cause of issue is spin_lock/spin_unlock instruction instead spin_lock_irqsave/spin_lock_irqrestore in cdnsp_thread_irq_handler function.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2025
The vulnerability described in CVE-2021-47271 represents a critical deadlock condition within the Linux kernel's USB driver subsystem, specifically affecting the cdnsp (Cdnsp USB Device Controller) driver implementation. This issue manifests as a system-wide hang during USB network control model (NCM) class operations, where the kernel becomes unresponsive due to improper locking mechanisms. The problem occurs in the cdnsp_thread_irq_handler function, which handles interrupt processing for the USB device controller. The deadlock condition arises from a fundamental flaw in the locking strategy that prevents the system from making forward progress. The kernel's diagnostic output reveals the system's detection of a non-responsive CSD (Cross-Socket Data) lock on CPU#0, indicating that a critical kernel lock has become unavailable and cannot be acquired by the executing thread. This condition is particularly severe because it affects the core interrupt handling mechanism of the USB subsystem, potentially leading to complete system hang or crash.
The technical root cause of this vulnerability stems from the improper use of spinlock functions within the cdnsp_thread_irq_handler. Specifically, the driver uses standard spin_lock and spin_unlock instructions instead of the more appropriate spin_lock_irqsave and spin_lock_irqrestore variants. This seemingly minor deviation has profound implications for interrupt handling and system stability. When a standard spin_lock is used, it does not disable interrupts during the lock acquisition process, which creates a race condition scenario where an interrupt handler can be preempted by another interrupt that attempts to acquire the same lock. The call trace demonstrates that the execution path leads through native_queued_spin_lock_slowpath and eventually to do_raw_spin_trylock, indicating that the system has entered a state where it cannot acquire the necessary lock due to the interrupt context being disabled. The function cdnsp_thread_irq_handler is designed to handle USB interrupt processing in a threaded context, but the improper locking mechanism prevents it from properly coordinating with the interrupt processing subsystem, leading to the deadlock scenario.
The operational impact of this vulnerability extends beyond simple system hangs, affecting the reliability and availability of USB network connectivity in embedded systems and devices that utilize the cdnsp USB controller. Systems using the NCM class for USB networking, such as USB-to-ethernet adapters, USB modems, or embedded devices with USB gadget functionality, become vulnerable to complete system lockups during normal operation. This vulnerability particularly affects devices that rely on USB networking functionality, as the deadlock occurs during packet transmission processing within the network control model driver. The implications are severe for embedded systems, IoT devices, and network appliances where USB connectivity is essential for operation, as these systems may become completely unresponsive and require manual intervention or power cycling to recover. The vulnerability affects kernel versions that include the cdnsp_udc_pci driver, making it a widespread concern across various Linux distributions and embedded platforms that support USB gadget functionality.
The fix for this vulnerability addresses the core locking mechanism issue by replacing the inappropriate spin_lock/spin_unlock calls with proper spin_lock_irqsave/spin_lock_irqrestore sequences. This change ensures that interrupts are properly disabled during lock acquisition, preventing the race conditions that lead to deadlock. The patch resolves the issue by maintaining proper interrupt context handling during the critical sections of the cdnsp_thread_irq_handler function, allowing the system to maintain proper synchronization between interrupt handlers and thread contexts. From a cybersecurity perspective, this vulnerability aligns with CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and represents a classic example of improper locking in concurrent systems. The fix demonstrates the importance of proper interrupt handling and locking protocols in kernel drivers, particularly those dealing with real-time interrupt processing and shared resources. This vulnerability also relates to ATT&CK technique T1499.001 (Network Denial of Service) as it can be exploited to cause system unavailability through resource exhaustion or lock contention, and T1547.001 (Registry Run Keys / Startup Folder) if the affected systems are part of larger attack chains targeting embedded or IoT devices. Organizations should prioritize patching this vulnerability, especially in systems where USB networking functionality is critical for operations, as the potential for complete system compromise exists through this fundamental locking failure.