| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-56585: LoongArch: Fix sleeping in atomic context for PREEMPT_RT |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| LoongArch: Fix sleeping in atomic context for PREEMPT_RT |
| |
| Commit bab1c299f3945ffe79 ("LoongArch: Fix sleeping in atomic context in |
| setup_tlb_handler()") changes the gfp flag from GFP_KERNEL to GFP_ATOMIC |
| for alloc_pages_node(). However, for PREEMPT_RT kernels we can still get |
| a "sleeping in atomic context" error: |
| |
| [ 0.372259] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 |
| [ 0.372266] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 |
| [ 0.372268] preempt_count: 1, expected: 0 |
| [ 0.372270] RCU nest depth: 1, expected: 1 |
| [ 0.372272] 3 locks held by swapper/1/0: |
| [ 0.372274] #0: 900000000c9f5e60 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x524/0x1c60 |
| [ 0.372294] #1: 90000000087013b8 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x50/0x140 |
| [ 0.372305] #2: 900000047fffd388 (&zone->lock){+.+.}-{3:3}, at: __rmqueue_pcplist+0x30c/0xea0 |
| [ 0.372314] irq event stamp: 0 |
| [ 0.372316] hardirqs last enabled at (0): [<0000000000000000>] 0x0 |
| [ 0.372322] hardirqs last disabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 |
| [ 0.372329] softirqs last enabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 |
| [ 0.372335] softirqs last disabled at (0): [<0000000000000000>] 0x0 |
| [ 0.372341] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7+ #1891 |
| [ 0.372346] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 |
| [ 0.372349] Stack : 0000000000000089 9000000005a0db9c 90000000071519c8 9000000100388000 |
| [ 0.372486] 900000010038b890 0000000000000000 900000010038b898 9000000007e53788 |
| [ 0.372492] 900000000815bcc8 900000000815bcc0 900000010038b700 0000000000000001 |
| [ 0.372498] 0000000000000001 4b031894b9d6b725 00000000055ec000 9000000100338fc0 |
| [ 0.372503] 00000000000000c4 0000000000000001 000000000000002d 0000000000000003 |
| [ 0.372509] 0000000000000030 0000000000000003 00000000055ec000 0000000000000003 |
| [ 0.372515] 900000000806d000 9000000007e53788 00000000000000b0 0000000000000004 |
| [ 0.372521] 0000000000000000 0000000000000000 900000000c9f5f10 0000000000000000 |
| [ 0.372526] 90000000076f12d8 9000000007e53788 9000000005924778 0000000000000000 |
| [ 0.372532] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 |
| [ 0.372537] ... |
| [ 0.372540] Call Trace: |
| [ 0.372542] [<9000000005924778>] show_stack+0x38/0x180 |
| [ 0.372548] [<90000000071519c4>] dump_stack_lvl+0x94/0xe4 |
| [ 0.372555] [<900000000599b880>] __might_resched+0x1a0/0x260 |
| [ 0.372561] [<90000000071675cc>] rt_spin_lock+0x4c/0x140 |
| [ 0.372565] [<9000000005cbb768>] __rmqueue_pcplist+0x308/0xea0 |
| [ 0.372570] [<9000000005cbed84>] get_page_from_freelist+0x564/0x1c60 |
| [ 0.372575] [<9000000005cc0d98>] __alloc_pages_noprof+0x218/0x1820 |
| [ 0.372580] [<900000000593b36c>] tlb_init+0x1ac/0x298 |
| [ 0.372585] [<9000000005924b74>] per_cpu_trap_init+0x114/0x140 |
| [ 0.372589] [<9000000005921964>] cpu_probe+0x4e4/0xa60 |
| [ 0.372592] [<9000000005934874>] start_secondary+0x34/0xc0 |
| [ 0.372599] [<900000000715615c>] smpboot_entry+0x64/0x6c |
| |
| This is because in PREEMPT_RT kernels normal spinlocks are replaced by |
| rt spinlocks and rt_spin_lock() will cause sleeping. Fix it by disabling |
| NUMA optimization completely for PREEMPT_RT kernels. |
| |
| The Linux kernel CVE team has assigned CVE-2024-56585 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.19 with commit fa96b57c149061f71a70bd6582d995f6424fbbf4 and fixed in 6.1.120 with commit 08715b741f9b2a925d6485491e4907f3b29bac70 |
| Issue introduced in 5.19 with commit fa96b57c149061f71a70bd6582d995f6424fbbf4 and fixed in 6.6.66 with commit c5f89458a2ea0800866b9fc690d3fa8367dc8f8d |
| Issue introduced in 5.19 with commit fa96b57c149061f71a70bd6582d995f6424fbbf4 and fixed in 6.12.5 with commit 6575e0867bd478a5d7ef1783ca1e73160807d238 |
| Issue introduced in 5.19 with commit fa96b57c149061f71a70bd6582d995f6424fbbf4 and fixed in 6.13 with commit 88fd2b70120d52c1010257d36776876941375490 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-56585 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/loongarch/mm/tlb.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/08715b741f9b2a925d6485491e4907f3b29bac70 |
| https://git.kernel.org/stable/c/c5f89458a2ea0800866b9fc690d3fa8367dc8f8d |
| https://git.kernel.org/stable/c/6575e0867bd478a5d7ef1783ca1e73160807d238 |
| https://git.kernel.org/stable/c/88fd2b70120d52c1010257d36776876941375490 |
