{
  "threat_severity" : "Moderate",
  "public_date" : "2025-12-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: interconnect: Fix locking for runpm vs reclaim",
    "id" : "2424943",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2424943"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-833",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ninterconnect: Fix locking for runpm vs reclaim\nFor cases where icc_bw_set() can be called in callbaths that could\ndeadlock against shrinker/reclaim, such as runpm resume, we need to\ndecouple the icc locking.  Introduce a new icc_bw_lock for cases where\nwe need to serialize bw aggregation and update to decouple that from\npaths that require memory allocation such as node/link creation/\ndestruction.\nFixes this lockdep splat:\n======================================================\nWARNING: possible circular locking dependency detected\n6.2.0-rc8-debug+ #554 Not tainted\n------------------------------------------------------\nring0/132 is trying to acquire lock:\nffffff80871916d0 (&gmu->lock){+.+.}-{3:3}, at: a6xx_pm_resume+0xf0/0x234\nbut task is already holding lock:\nffffffdb5aee57e8 (dma_fence_map){++++}-{0:0}, at: msm_job_run+0x68/0x150\nwhich lock already depends on the new lock.\nthe existing dependency chain (in reverse order) is:\n-> #4 (dma_fence_map){++++}-{0:0}:\n__dma_fence_might_wait+0x74/0xc0\ndma_resv_lockdep+0x1f4/0x2f4\ndo_one_initcall+0x104/0x2bc\nkernel_init_freeable+0x344/0x34c\nkernel_init+0x30/0x134\nret_from_fork+0x10/0x20\n-> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:\nfs_reclaim_acquire+0x80/0xa8\nslab_pre_alloc_hook.constprop.0+0x40/0x25c\n__kmem_cache_alloc_node+0x60/0x1cc\n__kmalloc+0xd8/0x100\ntopology_parse_cpu_capacity+0x8c/0x178\nget_cpu_for_node+0x88/0xc4\nparse_cluster+0x1b0/0x28c\nparse_cluster+0x8c/0x28c\ninit_cpu_topology+0x168/0x188\nsmp_prepare_cpus+0x24/0xf8\nkernel_init_freeable+0x18c/0x34c\nkernel_init+0x30/0x134\nret_from_fork+0x10/0x20\n-> #2 (fs_reclaim){+.+.}-{0:0}:\n__fs_reclaim_acquire+0x3c/0x48\nfs_reclaim_acquire+0x54/0xa8\nslab_pre_alloc_hook.constprop.0+0x40/0x25c\n__kmem_cache_alloc_node+0x60/0x1cc\n__kmalloc+0xd8/0x100\nkzalloc.constprop.0+0x14/0x20\nicc_node_create_nolock+0x4c/0xc4\nicc_node_create+0x38/0x58\nqcom_icc_rpmh_probe+0x1b8/0x248\nplatform_probe+0x70/0xc4\nreally_probe+0x158/0x290\n__driver_probe_device+0xc8/0xe0\ndriver_probe_device+0x44/0x100\n__driver_attach+0xf8/0x108\nbus_for_each_dev+0x78/0xc4\ndriver_attach+0x2c/0x38\nbus_add_driver+0xd0/0x1d8\ndriver_register+0xbc/0xf8\n__platform_driver_register+0x30/0x3c\nqnoc_driver_init+0x24/0x30\ndo_one_initcall+0x104/0x2bc\nkernel_init_freeable+0x344/0x34c\nkernel_init+0x30/0x134\nret_from_fork+0x10/0x20\n-> #1 (icc_lock){+.+.}-{3:3}:\n__mutex_lock+0xcc/0x3c8\nmutex_lock_nested+0x30/0x44\nicc_set_bw+0x88/0x2b4\n_set_opp_bw+0x8c/0xd8\n_set_opp+0x19c/0x300\ndev_pm_opp_set_opp+0x84/0x94\na6xx_gmu_resume+0x18c/0x804\na6xx_pm_resume+0xf8/0x234\nadreno_runtime_resume+0x2c/0x38\npm_generic_runtime_resume+0x30/0x44\n__rpm_callback+0x15c/0x174\nrpm_callback+0x78/0x7c\nrpm_resume+0x318/0x524\n__pm_runtime_resume+0x78/0xbc\nadreno_load_gpu+0xc4/0x17c\nmsm_open+0x50/0x120\ndrm_file_alloc+0x17c/0x228\ndrm_open_helper+0x74/0x118\ndrm_open+0xa0/0x144\ndrm_stub_open+0xd4/0xe4\nchrdev_open+0x1b8/0x1e4\ndo_dentry_open+0x2f8/0x38c\nvfs_open+0x34/0x40\npath_openat+0x64c/0x7b4\ndo_filp_open+0x54/0xc4\ndo_sys_openat2+0x9c/0x100\ndo_sys_open+0x50/0x7c\n__arm64_sys_openat+0x28/0x34\ninvoke_syscall+0x8c/0x128\nel0_svc_common.constprop.0+0xa0/0x11c\ndo_el0_\n---truncated---", "A deadlock vulnerability was found in the Linux kernel's interconnect subsystem. When icc_bw_set() is called during runtime power management resume paths, it can deadlock against the memory shrinker/reclaim mechanism. The existing icc_lock mutex is held during bandwidth aggregation while also being required for node creation which needs memory allocation, creating a circular lock dependency with fs_reclaim." ],
  "statement" : "This deadlock affects systems using the interconnect framework with runtime power management, primarily ARM-based SoCs with Qualcomm GPU drivers. The issue requires specific timing conditions where runtime resume coincides with memory pressure. While the deadlock causes a complete system hang requiring reboot, it does not allow code execution or data compromise.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-54013\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54013\nhttps://lore.kernel.org/linux-cve-announce/2025122431-CVE-2023-54013-c6e4@gregkh/T" ],
  "name" : "CVE-2023-54013",
  "csaw" : false
}