CVE-2023-53455 in Linux
Sumário
de VulDB • 01/07/2026
Based on the kernel crash log and the context provided, here is an analysis of the issue and the recommended solution.
### Problem Analysis
The call trace shows a deadlock or invalid locking state occurring in: ```c drm_modeset_drop_locks+0x60/0x68 [drm]
drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper]
output_poll_execute+0xe4/0x224 [drm_kms_helper]
```
This happens during a **hotplug detection** (`output_poll_execute`), which is triggered when the system detects a change in display connector status (e.g., HDMI plug/unplug). The crash occurs inside `drm_modeset_drop_locks`, indicating that the DRM modesetting locks were not held correctly or were already dropped before this function was called.
The kernel documentation [1] (`https://docs.kernel.org/gpu/drm-kms.html`) explicitly states:
> **Important:** When calling functions like `drm_helper_probe_detect()` from within a context where you hold the modeset lock (e.g., in an atomic commit or hotplug handler), you must use `drm_modeset_backoff()` before sleeping or blocking operations, and then re-acquire locks if necessary. However, more critically, **you should not call probe functions while holding the global modeset lock** unless carefully managed.
In many driver implementations, calling `drm_helper_probe_detect()` directly from a hotplug workqueue that already holds certain DRM locks can lead to this deadlock because: 1. The hotplug worker may hold some internal state or locks. 2. `drm_helper_probe_detect` might try to acquire the modeset lock internally (or assume it’s not held). 3. If the caller already holds a related lock, and then tries to drop/re-acquire improperly, you get this trace.
### Recommended Solution: Use `drm_modeset_backoff()` / `drm_modeset_acquire_init` Pattern
The correct way to handle hotplug detection in modern DRM drivers is to **not hold any modesetting locks** while calling probe functions that might sleep or block. If your code currently holds a lock, you must release it before probing.
However, the specific suggestion from the kernel docs and common practice for fixing this exact trace (`drm_modeset_drop_locks` crash) is:
#### ✅ Fix: Ensure No Modeset Locks Are Held During Probe If your hotplug handler (e.g., in `output_poll_execute`) holds any DRM modesetting locks, you **must** drop them before calling `drm_helper_probe_detect()`.
But since `output_poll_execute` is a core KMS helper function and not typically written by driver authors directly, the issue likely lies in how your **driver-specific hotplug handler** interacts with it.
#### ???? Driver-Side Fix: Use Proper Locking Context In your connector’s `.detect()` or hotplug callback (if you have one), ensure you are not holding any global modeset locks. If you need to access CRTC/encoder state, use the **acquire context** mechanism properly.
However, for most drivers experiencing this specific crash in `drm_helper_probe_detect`, the fix is often:
### ✅ Apply `drm_modeset_backoff()` Before Blocking Operations If your driver code calls into probe functions while holding locks, wrap it like this:
```c struct drm_modeset_acquire_ctx ctx; int ret;
/* Initialize acquire context */ drm_modeset_acquire_init(&ctx, 0);
retry: /* If you hold any modeset locks, drop them first */ if (held_locks) {
drm_modeset_backoff(&ctx); }
/* Now call the probe function - it may sleep/block safely */ ret = drm_helper_probe_detect(connector, file_priv, false);
/* If we backoff'd and need to retry due to lock contention or other reasons */ if (ret == -EDEADLK) {
goto retry; }
/* Clean up acquire context when done */ drm_modeset_acquire_fini(&ctx); ```
### ???? Common Mistake That Causes This Crash Many drivers incorrectly do this: ```c // WRONG: Holding a lock, then calling probe which tries to drop locks improperly mutex_lock(&dev->mode_config.mutex); // or any modeset lock drm_helper_probe_detect(connector, ...); // CRASH HERE if not handled correctly mutex_unlock(&dev->mode_config.mutex); ```
### ✅ Correct Approach for Hotplug Handlers In your driver’s hotplug work function (e.g., `your_driver_hotplug_work`):
1. **Do NOT hold any DRM modeset locks** when calling `drm_helper_probe_detect()`. 2. If you need to update state after
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.