CVE-2022-50045: 
Linux Kernel 5FOqC0

A vulnerability was identified in the Linux kernel's powerpc/pci subsystem (CVE-2022-50045) related to getphbnumber() locking. The issue was discovered when a recent change to getphbnumber() caused a DEBUGATOMICSLEEP warning on some systems due to improper lock handling (NVD).

The vulnerability stems from pcibiosalloccontroller() holding hosespinlock while ofaliasgetid() attempts to take ofmutex, which can sleep. The hosespinlock protects the phbbitmap and hoselist, but it doesn't need to be held while getphbnumber() calls the OF routines since those are only looking up information in the device tree (NVD, Wiz).

When triggered, this vulnerability causes a DEBUGATOMICSLEEP warning and potential system instability due to improper lock handling in the PowerPC PCI subsystem (Wiz).

The fix involves modifying getphbnumber() to take the hosespinlock only where required and dropping it before returning. The pcibiosalloccontroller() function then needs to take the lock again before the listadd() operation. This is safe as the order of the list is not important (NVD).