| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-53070: ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent |
| |
| Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") |
| enabled to map PPTT once on the first invocation of acpi_get_pptt() and |
| never unmapped the same allowing it to be used at runtime with out the |
| hassle of mapping and unmapping the table. This was needed to fetch LLC |
| information from the PPTT in the cpuhotplug path which is executed in |
| the atomic context as the acpi_get_table() might sleep waiting for a |
| mutex. |
| |
| However it missed to handle the case when there is no PPTT on the system |
| which results in acpi_get_pptt() being called from all the secondary |
| CPUs attempting to fetch the LLC information in the atomic context |
| without knowing the absence of PPTT resulting in the splat like below: |
| |
| | BUG: sleeping function called from invalid context at kernel/locking/semaphore.c:164 |
| | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 |
| | preempt_count: 1, expected: 0 |
| | RCU nest depth: 0, expected: 0 |
| | no locks held by swapper/1/0. |
| | irq event stamp: 0 |
| | hardirqs last enabled at (0): 0x0 |
| | hardirqs last disabled at (0): copy_process+0x61c/0x1b40 |
| | softirqs last enabled at (0): copy_process+0x61c/0x1b40 |
| | softirqs last disabled at (0): 0x0 |
| | CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.3.0-rc1 #1 |
| | Call trace: |
| | dump_backtrace+0xac/0x138 |
| | show_stack+0x30/0x48 |
| | dump_stack_lvl+0x60/0xb0 |
| | dump_stack+0x18/0x28 |
| | __might_resched+0x160/0x270 |
| | __might_sleep+0x58/0xb0 |
| | down_timeout+0x34/0x98 |
| | acpi_os_wait_semaphore+0x7c/0xc0 |
| | acpi_ut_acquire_mutex+0x58/0x108 |
| | acpi_get_table+0x40/0xe8 |
| | acpi_get_pptt+0x48/0xa0 |
| | acpi_get_cache_info+0x38/0x140 |
| | init_cache_level+0xf4/0x118 |
| | detect_cache_attributes+0x2e4/0x640 |
| | update_siblings_masks+0x3c/0x330 |
| | store_cpu_topology+0x88/0xf0 |
| | secondary_start_kernel+0xd0/0x168 |
| | __secondary_switched+0xb8/0xc0 |
| |
| Update acpi_get_pptt() to consider the fact that PPTT is once checked and |
| is not available on the system and return NULL avoiding any attempts to |
| fetch PPTT and thereby avoiding any possible sleep waiting for a mutex |
| in the atomic context. |
| |
| The Linux kernel CVE team has assigned CVE-2023-53070 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.0 with commit 0c80f9e165f8f9cca743d7b6cbdb54362da297e0 and fixed in 6.1.21 with commit 1318a07706bb2f8c65f88f39a16c2b5260bcdcd4 |
| Issue introduced in 6.0 with commit 0c80f9e165f8f9cca743d7b6cbdb54362da297e0 and fixed in 6.2.8 with commit e0c1106d51b9abc8eae03c5522b20649b6a55f6e |
| Issue introduced in 6.0 with commit 0c80f9e165f8f9cca743d7b6cbdb54362da297e0 and fixed in 6.3 with commit 91d7b60a65d9f71230ea09b86d2058a884a3c2af |
| Issue introduced in 5.19.4 with commit f03d253ba71994b196f342a7acad448a56812a8c |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-53070 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/acpi/pptt.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/1318a07706bb2f8c65f88f39a16c2b5260bcdcd4 |
| https://git.kernel.org/stable/c/e0c1106d51b9abc8eae03c5522b20649b6a55f6e |
| https://git.kernel.org/stable/c/91d7b60a65d9f71230ea09b86d2058a884a3c2af |
