CVE-2024-44981

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-44981
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-44981.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-44981
Downstream
Published
2024-09-04T19:54:31Z
Modified
2025-10-15T14:02:14.199666Z
Summary
workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask()
Details

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix UBSAN 'subtraction overflow' error in shiftandmask()

UBSAN reports the following 'subtraction overflow' error when booting in a virtual machine on Android:

| Internal error: UBSAN: integer subtraction overflow: 00000000f2005515 [#1] PREEMPT SMP | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-00006-g3cbe9e5abd46-dirty #4 | Hardware name: linux,dummy-virt (DT) | pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : canceldelayedwork+0x34/0x44 | lr : canceldelayedwork+0x2c/0x44 | sp : ffff80008002ba60 | x29: ffff80008002ba60 x28: 0000000000000000 x27: 0000000000000000 | x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 | x23: 0000000000000000 x22: 0000000000000000 x21: ffff1f65014cd3c0 | x20: ffffc0e84c9d0da0 x19: ffffc0e84cab3558 x18: ffff800080009058 | x17: 00000000247ee1f8 x16: 00000000247ee1f8 x15: 00000000bdcb279d | x14: 0000000000000001 x13: 0000000000000075 x12: 00000a0000000000 | x11: ffff1f6501499018 x10: 00984901651fffff x9 : ffff5e7cc35af000 | x8 : 0000000000000001 x7 : 3d4d455453595342 x6 : 000000004e514553 | x5 : ffff1f6501499265 x4 : ffff1f650ff60b10 x3 : 0000000000000620 | x2 : ffff80008002ba78 x1 : 0000000000000000 x0 : 0000000000000000 | Call trace: | canceldelayedwork+0x34/0x44 | deferredprobeextendtimeout+0x20/0x70 | driverregister+0xa8/0x110 | _platformdriverregister+0x28/0x3c | sysconinit+0x24/0x38 | dooneinitcall+0xe4/0x338 | doinitcalllevel+0xac/0x178 | doinitcalls+0x5c/0xa0 | dobasicsetup+0x20/0x30 | kernelinitfreeable+0x8c/0xf8 | kernelinit+0x28/0x1b4 | retfromfork+0x10/0x20 | Code: f9000fbf 97fffa2f 39400268 37100048 (d42aa2a0) | ---[ end trace 0000000000000000 ]--- | Kernel panic - not syncing: UBSAN: integer subtraction overflow: Fatal exception

This is due to shiftandmask() using a signed immediate to construct the mask and being called with a shift of 31 (WORKOFFQPOOLSHIFT) so that it ends up decrementing from INTMIN.

Use an unsigned constant '1U' to generate the mask in shiftandmask().

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1211f3b21c2aa0d22d8d7f050e3a5930a91cd0e4
Fixed
90a6a844b2d9927d192758438a4ada33d8cd9de5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1211f3b21c2aa0d22d8d7f050e3a5930a91cd0e4
Fixed
38f7e14519d39cf524ddc02d4caee9b337dad703

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.10.1
v6.10.2
v6.10.3
v6.10.4
v6.10.5
v6.10.6
v6.11-rc1
v6.9
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38f7e14519d39cf524ddc02d4caee9b337dad703",
        "signature_version": "v1",
        "target": {
            "file": "kernel/workqueue.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "175469189833220387956435401723995411974",
                "218015303327510934318943301367309995156",
                "335378831138529558164007662699973487642",
                "205083316169073678409846961807826183098"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2024-44981-205ff391"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90a6a844b2d9927d192758438a4ada33d8cd9de5",
        "signature_version": "v1",
        "target": {
            "file": "kernel/workqueue.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "175469189833220387956435401723995411974",
                "218015303327510934318943301367309995156",
                "335378831138529558164007662699973487642",
                "205083316169073678409846961807826183098"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2024-44981-63fcd58f"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90a6a844b2d9927d192758438a4ada33d8cd9de5",
        "signature_version": "v1",
        "target": {
            "file": "kernel/workqueue.c",
            "function": "shift_and_mask"
        },
        "digest": {
            "length": 140.0,
            "function_hash": "246566666395347989308356890917197463549"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2024-44981-78c396f5"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38f7e14519d39cf524ddc02d4caee9b337dad703",
        "signature_version": "v1",
        "target": {
            "file": "kernel/workqueue.c",
            "function": "shift_and_mask"
        },
        "digest": {
            "length": 140.0,
            "function_hash": "246566666395347989308356890917197463549"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2024-44981-e4fb463d"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.10.0
Fixed
6.10.7