CVE-2022-50652 in Linux
要約
〜によって VulDB • 2026年06月30日
Based on the stack trace provided, here is an analysis of what is happening and why it might be related to your `uio_dmem_genirq` driver.
### 1. Analysis of the Stack Trace
The key part of the log is:
```text [ 14.860090] schedule_hrtimeout_range+0x17/0x20
[ 14.860373] do_select+0x596/0x840
... [ 14.864893] core_sys_select+0x1c6/0x400
[ 14.865228] __x64_sys_pselect6+0x76/0xa0
```
* **What is happening?** A user-space process called `pselect()` (or `select()`) on the `/dev/uioX` device file associated with your FPGA driver. * **Why did it hang/block?** The kernel thread handling this system call entered a sleep state (`schedule_hrtimeout_range`) waiting for an event (specifically, "pollable" events like readability or writability). In UIO drivers, `select()`/`poll()` typically returns immediately if there is no interrupt pending, unless the driver implements custom poll logic. * **Is this necessarily a bug?** Not inherently. It’s normal behavior for `pselect()` to sleep until an event occurs (e.g., an interrupt makes the device "readable"). However, if it *stays* asleep indefinitely when you expect an interrupt, or if it wakes up but no data is available, that indicates a problem in the driver's interaction with the kernel’s poll/select infrastructure.
### 2. Connection to `uio_dmem_genirq` and Commit 34cb27528398
You mentioned: > "That commit... changed disable_irq() to disable_irq_nosync() in the implementation of irqcontrol(). The motivation there was to avoid a deadlock between irqcontrol() and handler(), since it added a spinlock in the irq handler..."
This is **critical context**. Here’s why this matters for your driver:
#### A. Deadlock Avoidance In `uio_pdrv_genirq`, after commit 34cb27528398, the flow is roughly: 1. User calls `ioctl(UIO_IRQ_CTRL)` to disable interrupts → calls `irqcontrol()`. 2. `irqcontrol()` acquires a spinlock (`uioc->uioinfo.lock`), then calls `disable_irq_nosync()`, releases lock. 3. If an interrupt fires *while* step 1–2 is happening, the handler might try to acquire the same spinlock → **deadlock**.
By using `disable_irq_nosync()` instead of `disable_irq()`: - The kernel does not wait for any currently running IRQ handlers to finish before returning. - This breaks the circular dependency: `irqcontrol()` doesn’t block waiting for the handler, so even if the handler runs concurrently and tries to take the lock (if it did), or more importantly, **the handler can complete without being blocked by a sleeping `disable_irq()`**.
#### B. Your Driver (`uio_dmem_genirq`) If your driver still uses `disable_irq()` in `irqcontrol()`, you risk: - A deadlock if an interrupt fires during the call to `disable_irq()`. - The system hanging, which could manifest as a process stuck in `pselect()` forever because no further interrupts are processed (the IRQ line is masked or deadlocked).
### 3. Why Might Your Driver Be Stuck?
If your application is calling `pselect()` and it appears to hang:
#### Possible Cause 1: Missing Poll Implementation The default UIO poll implementation checks if there’s a pending interrupt via the kernel’s IRQ subsystem. If you haven’t implemented `.poll` in your `uio_info`, or if your driver doesn’t properly signal that an event has occurred (via `wake_up_interruptible()`), then: - The user-space process sleeps forever. - Even when interrupts fire, no one wakes up the poll wait queue.
✅ **Fix:** Ensure you implement `.poll` in your `uio_info` structure if you want proper select/poll support. For simple drivers, you can often use a helper or manually wake up processes on interrupt.
#### Possible Cause 2: Interrupt Not Firing - Check dmesg for any "IRQ handler took too long" warnings. - Verify that the FPGA is actually asserting the IRQ line. - Ensure your `handler()` function correctly acknowledges and clears the interrupt source in hardware/firmware. If it doesn’t, subsequent interrupts
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.