In the Linux kernel, the following vulnerability has been resolved:
rcu/nocb: Fix WARNONONCE() in the rcunocbbypass_lock()
For the kernels built with CONFIGRCUNOCBCPUDEFAULTALL=y and CONFIGRCULAZY=y, the following scenarios will trigger WARNONONCE() in the rcunocbbypasslock() and rcunocbwait_contended() functions:
CPU2 CPU11
kthread rcunocbcbkthread ksyswrite rcudobatch vfswrite rcutorturetimercb procsyswrite _kmemcachefree procsyscallhandler kmemleakfree dropcachessysctlhandler deleteobjectfull dropslab _deleteobject shrinkslab putobject lazyrcushrinkscan callrcu rcunocbflushbypass _callrcucommn rcunocbbypasslock rawspintrylock(&rdp->nocbbypasslock) fail atomicinc(&rdp->nocblockcontended); rcunocbwaitcontended WARNONONCE(smpprocessorid() != rdp->cpu); WARNONONCE(atomicread(&rdp->nocblockcontended)) | | _ _ _ _ _ _ _ _ same rdp and rdp->cpu != 11 _ _ _ _ _ _ _ _ __|
Reproduce this bug with "echo 3 > /proc/sys/vm/drop_caches".
This commit therefore uses rcunocbtryflushbypass() instead of rcunocbflushbypass() in lazyrcushrinkscan(). If the nocbbypass queue is being flushed, then rcunocbtryflush_bypass will return directly.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dda98810b552fc6bf650f4270edeebdc2f28bd3f",
"target": {
"file": "kernel/rcu/tree_nocb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-35929-065f55b1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94494643440085225209990983178726716076",
"271642746045773550431492110634890618420",
"300735601989937621395050326638838647358",
"32861817872759523908716371895919263391"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dda98810b552fc6bf650f4270edeebdc2f28bd3f",
"target": {
"function": "lazy_rcu_shrink_scan",
"file": "kernel/rcu/tree_nocb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-35929-40175c9c",
"signature_type": "Function",
"digest": {
"length": 833.0,
"function_hash": "190736501311975604716427247123368419116"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d58c9fb45c70e62c19e8be3f3605889c47601bc",
"target": {
"function": "lazy_rcu_shrink_scan",
"file": "kernel/rcu/tree_nocb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-35929-6d060bc8",
"signature_type": "Function",
"digest": {
"length": 833.0,
"function_hash": "190736501311975604716427247123368419116"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d58c9fb45c70e62c19e8be3f3605889c47601bc",
"target": {
"file": "kernel/rcu/tree_nocb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-35929-8ae93625",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94494643440085225209990983178726716076",
"271642746045773550431492110634890618420",
"300735601989937621395050326638838647358",
"32861817872759523908716371895919263391"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@927d1f4f77e4784ab3944a9df86ab14d1cd3185a",
"target": {
"function": "lazy_rcu_shrink_scan",
"file": "kernel/rcu/tree_nocb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-35929-c69999f0",
"signature_type": "Function",
"digest": {
"length": 833.0,
"function_hash": "190736501311975604716427247123368419116"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@927d1f4f77e4784ab3944a9df86ab14d1cd3185a",
"target": {
"file": "kernel/rcu/tree_nocb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-35929-dc0c426b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94494643440085225209990983178726716076",
"271642746045773550431492110634890618420",
"300735601989937621395050326638838647358",
"32861817872759523908716371895919263391"
]
}
}
]