| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-40981: batman-adv: bypass empty buckets in batadv_purge_orig_ref() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| batman-adv: bypass empty buckets in batadv_purge_orig_ref() |
| |
| Many syzbot reports are pointing to soft lockups in |
| batadv_purge_orig_ref() [1] |
| |
| Root cause is unknown, but we can avoid spending too much |
| time there and perhaps get more interesting reports. |
| |
| [1] |
| |
| watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] |
| Modules linked in: |
| irq event stamp: 6182794 |
| hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 |
| hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] |
| hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 |
| softirqs last enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline] |
| softirqs last enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 |
| softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline] |
| softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 |
| CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 |
| Workqueue: bat_events batadv_purge_orig |
| pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) |
| pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] |
| pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 |
| lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 |
| sp : ffff800099007970 |
| x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000 |
| x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001 |
| x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4 |
| x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0 |
| x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001 |
| x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003 |
| x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 |
| x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 |
| x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 |
| x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000 |
| Call trace: |
| __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] |
| arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] |
| __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 |
| __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] |
| _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 |
| spin_unlock_bh include/linux/spinlock.h:396 [inline] |
| batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 |
| batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 |
| process_one_work+0x694/0x1204 kernel/workqueue.c:2633 |
| process_scheduled_works kernel/workqueue.c:2706 [inline] |
| worker_thread+0x938/0xef4 kernel/workqueue.c:2787 |
| kthread+0x288/0x310 kernel/kthread.c:388 |
| ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 |
| Sending NMI from CPU 0 to CPUs 1: |
| NMI backtrace for cpu 1 |
| CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 |
| pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) |
| pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 |
| lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103 |
| sp : ffff800093a17d30 |
| x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4 |
| x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002 |
| x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000 |
| x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396 |
| x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001 |
| x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003 |
| x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 |
| x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 |
| x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 |
| x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000 |
| Call trace: |
| __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] |
| arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 |
| cpuidle_idle_call kernel/sched/idle.c:170 [inline] |
| do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 |
| cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 |
| secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 |
| __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404 |
| |
| The Linux kernel CVE team has assigned CVE-2024-40981 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.19.317 with commit 79636f636126775436a11ee9cf00a9253a33ac11 |
| Fixed in 5.4.279 with commit 154e3f862ba33675cf3f4abf0a0a309a89df87d2 |
| Fixed in 5.10.221 with commit 82cdea8f3af1e36543c937df963d108c60bea030 |
| Fixed in 5.15.162 with commit 92176caf9896572f00e741a93cecc0ef1172da07 |
| Fixed in 6.1.96 with commit fed7914858a1f1f3e6350bb0f620d6ef15107d16 |
| Fixed in 6.6.36 with commit 2685008a5f9a636434a8508419cee8158a2f52c8 |
| Fixed in 6.9.7 with commit ae7f3cffe86aea3da0e8e079525a1ae619b8862a |
| Fixed in 6.10 with commit 40dc8ab605894acae1473e434944924a22cfaaa0 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-40981 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/batman-adv/originator.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/79636f636126775436a11ee9cf00a9253a33ac11 |
| https://git.kernel.org/stable/c/154e3f862ba33675cf3f4abf0a0a309a89df87d2 |
| https://git.kernel.org/stable/c/82cdea8f3af1e36543c937df963d108c60bea030 |
| https://git.kernel.org/stable/c/92176caf9896572f00e741a93cecc0ef1172da07 |
| https://git.kernel.org/stable/c/fed7914858a1f1f3e6350bb0f620d6ef15107d16 |
| https://git.kernel.org/stable/c/2685008a5f9a636434a8508419cee8158a2f52c8 |
| https://git.kernel.org/stable/c/ae7f3cffe86aea3da0e8e079525a1ae619b8862a |
| https://git.kernel.org/stable/c/40dc8ab605894acae1473e434944924a22cfaaa0 |
