In the Linux kernel, the following vulnerability has been resolved:
net/sched: actapi: fix possible infinite loop in tcfidrcheckalloc()
syzbot found hanging tasks waiting on rtnl_lock [1]
A reproducer is available in the syzbot bug.
When a request to add multiple actions with the same index is sent, the second request will block forever on the first request. This holds rtnl_lock, and causes tasks to hang.
Return -EAGAIN to prevent infinite looping, while keeping documented behavior.
[1]
INFO: task kworker/1:0:5088 blocked for more than 143 seconds. Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0 "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000 Workqueue: eventspowerefficient regcheckchanswork Call Trace: <TASK> contextswitch kernel/sched/core.c:5409 [inline] _schedule+0xf15/0x5d00 kernel/sched/core.c:6746 _scheduleloop kernel/sched/core.c:6823 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6838 schedulepreemptdisabled+0x13/0x30 kernel/sched/core.c:6895 _mutexlockcommon kernel/locking/mutex.c:684 [inline] _mutexlock+0x5b8/0x9c0 kernel/locking/mutex.c:752 wiphylock include/net/cfg80211.h:5953 [inline] regleaveinvalidchans net/wireless/reg.c:2466 [inline] regcheckchanswork+0x10a/0x10e0 net/wireless/reg.c:2481
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"73770925925518064380047753689947764809",
"33731536889712363501309463924242411279",
"301073391711908777431925337461728963118",
"172274868647081698436141376131633816463",
"132728754980442937280725283559390227257",
"326495842105883962735975891427672510662",
"321558264288209692369304988118121400239",
"246705855581118785684773488090886447369"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d864319871b05fadd153e0aede4811ca7008f5d6",
"target": {
"file": "net/sched/act_api.c"
},
"id": "CVE-2024-40995-2516394f"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 814.0,
"function_hash": "81681153481228456865228928562574255661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d8a2d287c8a394c0d4653f0c6c7be4c688e5a74",
"target": {
"file": "net/sched/act_api.c",
"function": "tcf_idr_check_alloc"
},
"id": "CVE-2024-40995-3b7ec4f7"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"73770925925518064380047753689947764809",
"33731536889712363501309463924242411279",
"301073391711908777431925337461728963118",
"172274868647081698436141376131633816463",
"132728754980442937280725283559390227257",
"326495842105883962735975891427672510662",
"321558264288209692369304988118121400239",
"246705855581118785684773488090886447369"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d8a2d287c8a394c0d4653f0c6c7be4c688e5a74",
"target": {
"file": "net/sched/act_api.c"
},
"id": "CVE-2024-40995-52111d1a"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"73770925925518064380047753689947764809",
"33731536889712363501309463924242411279",
"301073391711908777431925337461728963118",
"172274868647081698436141376131633816463",
"132728754980442937280725283559390227257",
"326495842105883962735975891427672510662",
"321558264288209692369304988118121400239",
"246705855581118785684773488090886447369"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6a7da65a296745535a964be1019ec7691b0cb90",
"target": {
"file": "net/sched/act_api.c"
},
"id": "CVE-2024-40995-70392347"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 814.0,
"function_hash": "81681153481228456865228928562574255661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25987a97eec4d5f897cd04ee1b45170829c610da",
"target": {
"file": "net/sched/act_api.c",
"function": "tcf_idr_check_alloc"
},
"id": "CVE-2024-40995-70d41d60"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 814.0,
"function_hash": "81681153481228456865228928562574255661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fc78d67f51aeb9a542d39a8714e16bc411582d4",
"target": {
"file": "net/sched/act_api.c",
"function": "tcf_idr_check_alloc"
},
"id": "CVE-2024-40995-77a5cd56"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"73770925925518064380047753689947764809",
"33731536889712363501309463924242411279",
"301073391711908777431925337461728963118",
"172274868647081698436141376131633816463",
"132728754980442937280725283559390227257",
"326495842105883962735975891427672510662",
"321558264288209692369304988118121400239",
"246705855581118785684773488090886447369"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25987a97eec4d5f897cd04ee1b45170829c610da",
"target": {
"file": "net/sched/act_api.c"
},
"id": "CVE-2024-40995-7e54a73a"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 814.0,
"function_hash": "81681153481228456865228928562574255661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6a7da65a296745535a964be1019ec7691b0cb90",
"target": {
"file": "net/sched/act_api.c",
"function": "tcf_idr_check_alloc"
},
"id": "CVE-2024-40995-a89c74b8"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"73770925925518064380047753689947764809",
"33731536889712363501309463924242411279",
"301073391711908777431925337461728963118",
"172274868647081698436141376131633816463",
"132728754980442937280725283559390227257",
"326495842105883962735975891427672510662",
"321558264288209692369304988118121400239",
"246705855581118785684773488090886447369"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a0e497b597df7c4cf2b63fc6e9188b6cabe5335",
"target": {
"file": "net/sched/act_api.c"
},
"id": "CVE-2024-40995-c3b6099b"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 814.0,
"function_hash": "81681153481228456865228928562574255661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a0e497b597df7c4cf2b63fc6e9188b6cabe5335",
"target": {
"file": "net/sched/act_api.c",
"function": "tcf_idr_check_alloc"
},
"id": "CVE-2024-40995-ea2306be"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 814.0,
"function_hash": "81681153481228456865228928562574255661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d864319871b05fadd153e0aede4811ca7008f5d6",
"target": {
"file": "net/sched/act_api.c",
"function": "tcf_idr_check_alloc"
},
"id": "CVE-2024-40995-eae8e430"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"73770925925518064380047753689947764809",
"33731536889712363501309463924242411279",
"301073391711908777431925337461728963118",
"172274868647081698436141376131633816463",
"132728754980442937280725283559390227257",
"326495842105883962735975891427672510662",
"321558264288209692369304988118121400239",
"246705855581118785684773488090886447369"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fc78d67f51aeb9a542d39a8714e16bc411582d4",
"target": {
"file": "net/sched/act_api.c"
},
"id": "CVE-2024-40995-fed273aa"
}
]