| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-44975: cgroup/cpuset: fix panic caused by partcmd_update |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| cgroup/cpuset: fix panic caused by partcmd_update |
| |
| We find a bug as below: |
| BUG: unable to handle page fault for address: 00000003 |
| PGD 0 P4D 0 |
| Oops: 0000 [#1] PREEMPT SMP NOPTI |
| CPU: 3 PID: 358 Comm: bash Tainted: G W I 6.6.0-10893-g60d6 |
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/4 |
| RIP: 0010:partition_sched_domains_locked+0x483/0x600 |
| Code: 01 48 85 d2 74 0d 48 83 05 29 3f f8 03 01 f3 48 0f bc c2 89 c0 48 9 |
| RSP: 0018:ffffc90000fdbc58 EFLAGS: 00000202 |
| RAX: 0000000100000003 RBX: ffff888100b3dfa0 RCX: 0000000000000000 |
| RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000002fe80 |
| RBP: ffff888100b3dfb0 R08: 0000000000000001 R09: 0000000000000000 |
| R10: ffffc90000fdbcb0 R11: 0000000000000004 R12: 0000000000000002 |
| R13: ffff888100a92b48 R14: 0000000000000000 R15: 0000000000000000 |
| FS: 00007f44a5425740(0000) GS:ffff888237d80000(0000) knlGS:0000000000000 |
| CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| CR2: 0000000100030973 CR3: 000000010722c000 CR4: 00000000000006e0 |
| Call Trace: |
| <TASK> |
| ? show_regs+0x8c/0xa0 |
| ? __die_body+0x23/0xa0 |
| ? __die+0x3a/0x50 |
| ? page_fault_oops+0x1d2/0x5c0 |
| ? partition_sched_domains_locked+0x483/0x600 |
| ? search_module_extables+0x2a/0xb0 |
| ? search_exception_tables+0x67/0x90 |
| ? kernelmode_fixup_or_oops+0x144/0x1b0 |
| ? __bad_area_nosemaphore+0x211/0x360 |
| ? up_read+0x3b/0x50 |
| ? bad_area_nosemaphore+0x1a/0x30 |
| ? exc_page_fault+0x890/0xd90 |
| ? __lock_acquire.constprop.0+0x24f/0x8d0 |
| ? __lock_acquire.constprop.0+0x24f/0x8d0 |
| ? asm_exc_page_fault+0x26/0x30 |
| ? partition_sched_domains_locked+0x483/0x600 |
| ? partition_sched_domains_locked+0xf0/0x600 |
| rebuild_sched_domains_locked+0x806/0xdc0 |
| update_partition_sd_lb+0x118/0x130 |
| cpuset_write_resmask+0xffc/0x1420 |
| cgroup_file_write+0xb2/0x290 |
| kernfs_fop_write_iter+0x194/0x290 |
| new_sync_write+0xeb/0x160 |
| vfs_write+0x16f/0x1d0 |
| ksys_write+0x81/0x180 |
| __x64_sys_write+0x21/0x30 |
| x64_sys_call+0x2f25/0x4630 |
| do_syscall_64+0x44/0xb0 |
| entry_SYSCALL_64_after_hwframe+0x78/0xe2 |
| RIP: 0033:0x7f44a553c887 |
| |
| It can be reproduced with cammands: |
| cd /sys/fs/cgroup/ |
| mkdir test |
| cd test/ |
| echo +cpuset > ../cgroup.subtree_control |
| echo root > cpuset.cpus.partition |
| cat /sys/fs/cgroup/cpuset.cpus.effective |
| 0-3 |
| echo 0-3 > cpuset.cpus // taking away all cpus from root |
| |
| This issue is caused by the incorrect rebuilding of scheduling domains. |
| In this scenario, test/cpuset.cpus.partition should be an invalid root |
| and should not trigger the rebuilding of scheduling domains. When calling |
| update_parent_effective_cpumask with partcmd_update, if newmask is not |
| null, it should recheck newmask whether there are cpus is available |
| for parect/cs that has tasks. |
| |
| The Linux kernel CVE team has assigned CVE-2024-44975 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.7 with commit 0c7f293efc87a06b51db9aa65256f8cb0a5a0a21 and fixed in 6.10.7 with commit 73d6c6cf8ef6a3c532aa159f5114077746a372d6 |
| Issue introduced in 6.7 with commit 0c7f293efc87a06b51db9aa65256f8cb0a5a0a21 and fixed in 6.11 with commit 959ab6350add903e352890af53e86663739fcb9a |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-44975 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| kernel/cgroup/cpuset.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/73d6c6cf8ef6a3c532aa159f5114077746a372d6 |
| https://git.kernel.org/stable/c/959ab6350add903e352890af53e86663739fcb9a |
