CVE-2021-47185

tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc

MEDIUM
4.4
CVSS Score
Published: April 10, 2024 at 06:56 PM UTC
Updated: June 17, 2026 at 04:16 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM4.4
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, which look like this one: Workqueue: events_unbound flush_to_ldisc Call trace: dump_backtrace+0x0/0x1ec show_stack+0x24/0x30 dump_stack+0xd0/0x128 panic+0x15c/0x374 watchdog_timer_fn+0x2b8/0x304 __run_hrtimer+0x88/0x2c0 __hrtimer_run_queues+0xa4/0x120 hrtimer_interrupt+0xfc/0x270 arch_timer_handler_phys+0x40/0x50 handle_percpu_devid_irq+0x94/0x220 __handle_domain_irq+0x88/0xf0 gic_handle_irq+0x84/0xfc el1_irq+0xc8/0x180 slip_unesc+0x80/0x214 [slip] tty_ldisc_receive_buf+0x64/0x80 tty_port_default_receive_buf+0x50/0x90 flush_to_ldisc+0xbc/0x110 process_one_work+0x1d4/0x4b0 worker_thread+0x180/0x430 kthread+0x11c/0x120 In the testcase pty04, The first process call the write syscall to send data to the pty master. At the same time, the workqueue will do the flush_to_ldisc to pop data in a loop until there is no more data left. When the sender and workqueue running in different core, the sender sends data fastly in full time which will result in workqueue doing work in loop for a long time and occuring softlockup in flush_to_ldisc with kernel configured without preempt. So I add need_resched check and cond_resched in the flush_to_ldisc loop to avoid it.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 4.4.2933.0 ≤ v < 4.14.2563.0 ≤ v < 4.19.2183.0 ≤ v < 4.4.2933.0 ≤ v < 4.9.2913.0 ≤ v < 5.10.823.0 ≤ v < 5.15.53.0 ≤ v < 5.163.0 ≤ v < 5.4.1624.10 ≤ v < 4.14.2564.15 ≤ v < 4.19.2184.20 ≤ v < 5.4.1624.5 ≤ v < 4.9.2915.11 ≤ v < 5.15.55.5 ≤ v < 5.10.823.081de916f19cf5f1437c0b9ed817364f0f7c81961
Vendor states this is fixed in 0380f643f3a7a61b0845cdc738959c2ad5735d61 (fixed)
Vendor states this is fixed in 3968ddcf05fb4b9409cd1859feb06a5b0550a1c1 (fixed)
Vendor states this is fixed in 4c1623651a0936ee197859824cdae6ebbd04d3ed (fixed)
Vendor states this is fixed in 4f300f47dbcf9c3d4b2ea76c8554c8f360400725 (fixed)
Vendor states this is fixed in 5c34486f04700f1ba04907231dce0cc2705c2d7d (fixed)
Vendor states this is fixed in 77e9fed33056f2a88eba9dd4d2d5412f0c7d1f41 (fixed)
Vendor states this is fixed in b1ffc16ec05ae40d82b6e373322d62e9d6b54fbc (fixed)
Vendor states this is fixed in d491c84df5c469dd9621863b6a770b3428137063 (fixed)
Vendor states this is fixed in 3.0 (unaffected)
Vendor states this is fixed in 4.14.256 (unaffected)
Vendor states this is fixed in 4.19.218 (unaffected)
Vendor states this is fixed in 4.4.293 (unaffected)
Vendor states this is fixed in 4.9.291 (unaffected)
Vendor states this is fixed in 5.10.82 (unaffected)
Vendor states this is fixed in 5.15.5 (unaffected)
Vendor states this is fixed in 5.16 (unaffected)
Vendor states this is fixed in 5.4.162 (unaffected)

References (8)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0380f643f3a7a61b0845cdc738959c2ad5735d61
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3968ddcf05fb4b9409cd1859feb06a5b0550a1c1
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4c1623651a0936ee197859824cdae6ebbd04d3ed
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4f300f47dbcf9c3d4b2ea76c8554c8f360400725
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5c34486f04700f1ba04907231dce0cc2705c2d7d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/77e9fed33056f2a88eba9dd4d2d5412f0c7d1f41
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b1ffc16ec05ae40d82b6e373322d62e9d6b54fbc
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d491c84df5c469dd9621863b6a770b3428137063

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.4MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-667

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card