CVE-2025-21912

In the Linux kernel, the following vulnerability has been resolved:

gpio: rcar: Use raw_spinlock to protect register access

Use raw_spinlock in order to fix spurious messages about invalid context when spinlock debugging is enabled. The lock is only used to serialize register access.

[    4.239592] =============================
[    4.239595] [ BUG: Invalid wait context ]
[    4.239599] 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 Not tainted
[    4.239603] -----------------------------
[    4.239606] kworker/u8:5/76 is trying to lock:
[    4.239609] ffff0000091898a0 (&p->lock){....}-{3:3}, at: gpio_rcar_config_interrupt_input_mode+0x34/0x164
[    4.239641] other info that might help us debug this:
[    4.239643] context-{5:5}
[    4.239646] 5 locks held by kworker/u8:5/76:
[    4.239651]  #0: ffff0000080fb148 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x190/0x62c
[    4.250180] OF: /soc/sound@ec500000/ports/port@0/endpoint: Read of boolean property frame-master with a value.
[    4.254094]  #1: ffff80008299bd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c
[    4.254109]  #2: ffff00000920c8f8
[    4.258345] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property bitclock-master with a value.
[    4.264803]  (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper+0x3c/0xdc
[    4.264820]  #3: ffff00000a50ca40 (request_class#2){+.+.}-{4:4}, at: __setup_irq+0xa0/0x690
[    4.264840]  #4:
[    4.268872] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property frame-master with a value.
[    4.273275] ffff00000a50c8c8 (lock_class){....}-{2:2}, at: __setup_irq+0xc4/0x690
[    4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee100000, max clock rate 200 MHz
[    4.304082] stack backtrace:
[    4.304086] CPU: 1 UID: 0 PID: 76 Comm: kworker/u8:5 Not tainted 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35
[    4.304092] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
[    4.304097] Workqueue: async async_run_entry_fn
[    4.304106] Call trace:
[    4.304110]  show_stack+0x14/0x20 (C)
[    4.304122]  dump_stack_lvl+0x6c/0x90
[    4.304131]  dump_stack+0x14/0x1c
[    4.304138]  __lock_acquire+0xdfc/0x1584
[    4.426274]  lock_acquire+0x1c4/0x33c
[    4.429942]  _raw_spin_lock_irqsave+0x5c/0x80
[    4.434307]  gpio_rcar_config_interrupt_input_mode+0x34/0x164
[    4.440061]  gpio_rcar_irq_set_type+0xd4/0xd8
[    4.444422]  __irq_set_trigger+0x5c/0x178
[    4.448435]  __setup_irq+0x2e4/0x690
[    4.452012]  request_threaded_irq+0xc4/0x190
[    4.456285]  devm_request_threaded_irq+0x7c/0xf4
[    4.459398] ata1: link resume succeeded after 1 retries
[    4.460902]  mmc_gpiod_request_cd_irq+0x68/0xe0
[    4.470660]  mmc_start_host+0x50/0xac
[    4.474327]  mmc_add_host+0x80/0xe4
[    4.477817]  tmio_mmc_host_probe+0x2b0/0x440
[    4.482094]  renesas_sdhi_probe+0x488/0x6f4
[    4.486281]  renesas_sdhi_internal_dmac_probe+0x60/0x78
[    4.491509]  platform_probe+0x64/0xd8
[    4.495178]  really_probe+0xb8/0x2a8
[    4.498756]  __driver_probe_device+0x74/0x118
[    4.503116]  driver_probe_device+0x3c/0x154
[    4.507303]  __device_attach_driver+0xd4/0x160
[    4.511750]  bus_for_each_drv+0x84/0xe0
[    4.515588]  __device_attach_async_helper+0xb0/0xdc
[    4.520470]  async_run_entry_fn+0x30/0xd8
[    4.524481]  process_one_work+0x210/0x62c
[    4.528494]  worker_thread+0x1ac/0x340
[    4.532245]  kthread+0x10c/0x110
[    4.535476]  ret_from_fork+0x10/0x20

Weakness

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Affected Software

Extended Description

Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/25.html
• https://cwe.mitre.org/data/definitions/26.html
• https://cwe.mitre.org/data/definitions/27.html

References

• https://git.kernel.org/stable/c/389891ac9f678baf68e13623ef1308493af4b074
• https://git.kernel.org/stable/c/3e300913c42041e81c5b17a970c4e078086ff2d1
• https://git.kernel.org/stable/c/51ef3073493e2a25dced05fdd59dfb059e7e284d
• https://git.kernel.org/stable/c/7c1f36f9c9aca507d317479a3d3388150ae40a87
• https://git.kernel.org/stable/c/b42c84f9e4ec5bc2885e7fd80c79ec0352f5d2af
• https://git.kernel.org/stable/c/c10365031f16514a29c812cd909085a6e4ea4b61
• https://git.kernel.org/stable/c/f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html