In the Linux kernel, the following vulnerability has been resolved:
sched, cpuset: Fix dlcpubusy() panic due to empty cs->cpus_allowed
With cgroup v2, the cpuset's cpusallowed mask can be empty indicating that the cpuset will just use the effective CPUs of its parent. So cpusetcanattach() can call taskcanattach() with an empty mask. This can lead to cpumaskanyand() returns nrcpuids causing the call to dlbw_of() to crash due to percpu value access of an out of bound CPU value. For example:
[80468.182258] BUG: unable to handle page fault for address: ffffffff8b6648b0
:
[80468.191019] RIP: 0010:dl_cpu_busy+0x30/0x2b0
:
[80468.207946] Call Trace:
[80468.208947] cpuset_can_attach+0xa0/0x140
[80468.209953] cgroup_migrate_execute+0x8c/0x490
[80468.210931] cgroup_update_dfl_csses+0x254/0x270
[80468.211898] cgroup_subtree_control_write+0x322/0x400
[80468.212854] kernfs_fop_write_iter+0x11c/0x1b0
[80468.213777] new_sync_write+0x11f/0x1b0
[80468.214689] vfs_write+0x1eb/0x280
[80468.215592] ksys_write+0x5f/0xe0
[80468.216463] do_syscall_64+0x5c/0x80
[80468.224287] entry_SYSCALL_64_after_hwframe+0x44/0xae
Fix that by using effectivecpus instead. For cgroup v1, effectivecpus is the same as cpusallowed. For v2, effectivecpus is the real cpumask to be used by tasks within the cpuset anyway.
Also update taskcanattach()'s 2nd argument name to cseffectivecpus to reflect the change. In addition, a check is added to taskcanattach() to guard against the possibility that cpumaskanyand() may return a value >= nrcpuids.
[
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"74027841748342193183902066602320343245",
"308970820782369987811100505815542241167",
"308836933115856090329355602749993697090",
"176319621144963742688488028263931183010",
"178244316327002811873637260593779416864",
"60849954828207020945026513735306549555",
"317246015857745454257044059699503239331",
"40683450381811692507239881627143170566",
"43605298708978817716336094768571443389"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e8d40d43ae4dec00c8fea2593eeea3114b8f44",
"id": "CVE-2022-50103-05c572d4"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "244904277128997709573789089528454896617",
"length": 627.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "cpuset_can_attach",
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f56607b44c9896e51678a7e8cdd3a5479f4b4548",
"id": "CVE-2022-50103-0c43f705"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244438678008916582966907118748431496871",
"276180672370850079925859226369675912978",
"28831901540410633514183900943330651075",
"282208894700110664063094573157488262013"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/linux/sched.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147f66d22f58712dce7ccdd6a1f6cb3ee8042df4",
"id": "CVE-2022-50103-1d129e62"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"74027841748342193183902066602320343245",
"308970820782369987811100505815542241167",
"308836933115856090329355602749993697090",
"176319621144963742688488028263931183010",
"178244316327002811873637260593779416864",
"60849954828207020945026513735306549555",
"317246015857745454257044059699503239331",
"40683450381811692507239881627143170566",
"43605298708978817716336094768571443389"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f56607b44c9896e51678a7e8cdd3a5479f4b4548",
"id": "CVE-2022-50103-1d902cf7"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "244904277128997709573789089528454896617",
"length": 627.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "cpuset_can_attach",
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e8d40d43ae4dec00c8fea2593eeea3114b8f44",
"id": "CVE-2022-50103-23a63f52"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244438678008916582966907118748431496871",
"276180672370850079925859226369675912978",
"28831901540410633514183900943330651075",
"282208894700110664063094573157488262013"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/linux/sched.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e8d40d43ae4dec00c8fea2593eeea3114b8f44",
"id": "CVE-2022-50103-360f5244"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "189186346003697802800027185699047550380",
"length": 340.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "task_can_attach",
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@357f3f0e522a6ce1ce4a571cb780d9861d53bec7",
"id": "CVE-2022-50103-447291a8"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "189186346003697802800027185699047550380",
"length": 340.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "task_can_attach",
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336626564b58071b8980a4e6a31a8f5d92705d9b",
"id": "CVE-2022-50103-493273c1"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"221633218552439418444719293046801140544",
"66473196738484662954361362280270666166",
"100527503725126507747910539850848369891",
"156187138578127487244664866504591832569"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@357f3f0e522a6ce1ce4a571cb780d9861d53bec7",
"id": "CVE-2022-50103-4c67b82c"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"221633218552439418444719293046801140544",
"66473196738484662954361362280270666166",
"100527503725126507747910539850848369891",
"156187138578127487244664866504591832569"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f56607b44c9896e51678a7e8cdd3a5479f4b4548",
"id": "CVE-2022-50103-687d15d2"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"221633218552439418444719293046801140544",
"66473196738484662954361362280270666166",
"100527503725126507747910539850848369891",
"156187138578127487244664866504591832569"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e8d40d43ae4dec00c8fea2593eeea3114b8f44",
"id": "CVE-2022-50103-6a7feb20"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"221633218552439418444719293046801140544",
"66473196738484662954361362280270666166",
"100527503725126507747910539850848369891",
"156187138578127487244664866504591832569"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336626564b58071b8980a4e6a31a8f5d92705d9b",
"id": "CVE-2022-50103-6c1ad575"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "244904277128997709573789089528454896617",
"length": 627.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "cpuset_can_attach",
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147f66d22f58712dce7ccdd6a1f6cb3ee8042df4",
"id": "CVE-2022-50103-7c13b059"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244438678008916582966907118748431496871",
"276180672370850079925859226369675912978",
"28831901540410633514183900943330651075",
"282208894700110664063094573157488262013"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/linux/sched.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336626564b58071b8980a4e6a31a8f5d92705d9b",
"id": "CVE-2022-50103-82808f71"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244438678008916582966907118748431496871",
"276180672370850079925859226369675912978",
"28831901540410633514183900943330651075",
"282208894700110664063094573157488262013"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/linux/sched.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@357f3f0e522a6ce1ce4a571cb780d9861d53bec7",
"id": "CVE-2022-50103-83d794ea"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "244904277128997709573789089528454896617",
"length": 627.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "cpuset_can_attach",
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336626564b58071b8980a4e6a31a8f5d92705d9b",
"id": "CVE-2022-50103-93c3ae41"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "189186346003697802800027185699047550380",
"length": 340.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "task_can_attach",
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147f66d22f58712dce7ccdd6a1f6cb3ee8042df4",
"id": "CVE-2022-50103-ace219cb"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"74027841748342193183902066602320343245",
"308970820782369987811100505815542241167",
"308836933115856090329355602749993697090",
"176319621144963742688488028263931183010",
"178244316327002811873637260593779416864",
"60849954828207020945026513735306549555",
"317246015857745454257044059699503239331",
"40683450381811692507239881627143170566",
"43605298708978817716336094768571443389"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147f66d22f58712dce7ccdd6a1f6cb3ee8042df4",
"id": "CVE-2022-50103-b605fb8e"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244438678008916582966907118748431496871",
"276180672370850079925859226369675912978",
"28831901540410633514183900943330651075",
"282208894700110664063094573157488262013"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/linux/sched.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f56607b44c9896e51678a7e8cdd3a5479f4b4548",
"id": "CVE-2022-50103-c55bbbdc"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"74027841748342193183902066602320343245",
"308970820782369987811100505815542241167",
"308836933115856090329355602749993697090",
"176319621144963742688488028263931183010",
"178244316327002811873637260593779416864",
"60849954828207020945026513735306549555",
"317246015857745454257044059699503239331",
"40683450381811692507239881627143170566",
"43605298708978817716336094768571443389"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@357f3f0e522a6ce1ce4a571cb780d9861d53bec7",
"id": "CVE-2022-50103-c6109988"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "244904277128997709573789089528454896617",
"length": 627.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "cpuset_can_attach",
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@357f3f0e522a6ce1ce4a571cb780d9861d53bec7",
"id": "CVE-2022-50103-d5475e50"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "189186346003697802800027185699047550380",
"length": 340.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "task_can_attach",
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f56607b44c9896e51678a7e8cdd3a5479f4b4548",
"id": "CVE-2022-50103-d5f9ffa7"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"74027841748342193183902066602320343245",
"308970820782369987811100505815542241167",
"308836933115856090329355602749993697090",
"176319621144963742688488028263931183010",
"178244316327002811873637260593779416864",
"60849954828207020945026513735306549555",
"317246015857745454257044059699503239331",
"40683450381811692507239881627143170566",
"43605298708978817716336094768571443389"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336626564b58071b8980a4e6a31a8f5d92705d9b",
"id": "CVE-2022-50103-e1bd188a"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "189186346003697802800027185699047550380",
"length": 340.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "task_can_attach",
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e8d40d43ae4dec00c8fea2593eeea3114b8f44",
"id": "CVE-2022-50103-eecfb43a"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"221633218552439418444719293046801140544",
"66473196738484662954361362280270666166",
"100527503725126507747910539850848369891",
"156187138578127487244664866504591832569"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "kernel/cgroup/cpuset.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147f66d22f58712dce7ccdd6a1f6cb3ee8042df4",
"id": "CVE-2022-50103-f6d0ded2"
}
]