In the Linux kernel, the following vulnerability has been resolved:
bonding: change ipsec_lock from spin lock to mutex
In the cited commit, bond->ipseclock is added to protect ipseclist, hence xdodevstateadd and xdodevstatedelete are called inside this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep, "scheduling while atomic" will be triggered when changing bond's active slave.
[ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200 [ 101.055726] Modules linked in: [ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1 [ 101.058760] Hardware name: [ 101.059434] Call Trace: [ 101.059436] <TASK> [ 101.060873] dumpstacklvl+0x51/0x60 [ 101.061275] _schedulebug+0x4e/0x60 [ 101.061682] _schedule+0x612/0x7c0 [ 101.062078] ? _modtimer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] scheduletimeout+0x77/0xf0 [ 101.063265] ? asmcommoninterrupt+0x22/0x40 [ 101.063724] ? _bpftraceitimerstate+0x10/0x10 [ 101.064215] _waitforcommon+0x87/0x190 [ 101.064648] ? usleeprangestate+0x90/0x90 [ 101.065091] cmdexec+0x437/0xb20 [mlx5core] [ 101.065569] mlx5cmddo+0x1e/0x40 [mlx5core] [ 101.066051] mlx5cmdexec+0x18/0x30 [mlx5core] [ 101.066552] mlx5cryptocreatedekkey+0xea/0x120 [mlx5core] [ 101.067163] ? bondingsysfsstoreoption+0x4d/0x80 [bonding] [ 101.067738] ? kmalloctrace+0x4d/0x350 [ 101.068156] mlx5ipseccreatesactx+0x33/0x100 [mlx5core] [ 101.068747] mlx5exfrmaddstate+0x47b/0xaa0 [mlx5core] [ 101.069312] bondchangeactiveslave+0x392/0x900 [bonding] [ 101.069868] bondoptionactiveslaveset+0x1c2/0x240 [bonding] [ 101.070454] _bondoptset+0xa6/0x430 [bonding] [ 101.070935] _bondoptsetnotify+0x2f/0x90 [bonding] [ 101.071453] bondopttrysetrtnl+0x72/0xb0 [bonding] [ 101.071965] bondingsysfsstoreoption+0x4d/0x80 [bonding] [ 101.072567] kernfsfopwriteiter+0x10c/0x1a0 [ 101.073033] vfswrite+0x2d8/0x400 [ 101.073416] ? allocfd+0x48/0x180 [ 101.073798] ksyswrite+0x5f/0xe0 [ 101.074175] dosyscall64+0x52/0x110 [ 101.074576] entrySYSCALL64after_hwframe+0x4b/0x53
As bondipsecaddsaall and bondipsecdelsaall are only called from bondchangeactiveslave, which requires holding the RTNL lock. And bondipsecaddsa and bondipsecdelsa are xfrm state xdodevstateadd and xdodevstatedelete APIs, which are in user context. So ipseclock doesn't have to be spin lock, change it to mutex, and thus the above issue can be resolved.
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 980.0,
"function_hash": "244129659844457000418818814899668287957"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_ipsec_add_sa"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aeeef906d5a526dc60cf4af92eda69836c39b1f",
"signature_version": "v1",
"id": "CVE-2024-46678-14f988d1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 348.0,
"function_hash": "310530838423907955112552068703712480994"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_uninit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aeeef906d5a526dc60cf4af92eda69836c39b1f",
"signature_version": "v1",
"id": "CVE-2024-46678-162015e8"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"131389781964170256706173779730043613076",
"213333545424447916799971098941091915988",
"182320529700887938257568641086176031109",
"69539523535792426342557044197721991372"
],
"threshold": 0.9
},
"target": {
"file": "include/net/bonding.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b598069164ac1bb60996d6ff94e7f9169dbd2d3",
"signature_version": "v1",
"id": "CVE-2024-46678-22aeee93"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 348.0,
"function_hash": "310530838423907955112552068703712480994"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_uninit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b598069164ac1bb60996d6ff94e7f9169dbd2d3",
"signature_version": "v1",
"id": "CVE-2024-46678-4d922389"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 980.0,
"function_hash": "244129659844457000418818814899668287957"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_ipsec_add_sa"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b598069164ac1bb60996d6ff94e7f9169dbd2d3",
"signature_version": "v1",
"id": "CVE-2024-46678-5c6d8bb0"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 848.0,
"function_hash": "194868208867400252058758636142016395694"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_ipsec_del_sa"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aeeef906d5a526dc60cf4af92eda69836c39b1f",
"signature_version": "v1",
"id": "CVE-2024-46678-62a5e2ec"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 781.0,
"function_hash": "164942018493480490900114123545510316632"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_ipsec_del_sa_all"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aeeef906d5a526dc60cf4af92eda69836c39b1f",
"signature_version": "v1",
"id": "CVE-2024-46678-6ad4e1ea"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 875.0,
"function_hash": "72220186914272486990825094666672817021"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_ipsec_add_sa_all"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aeeef906d5a526dc60cf4af92eda69836c39b1f",
"signature_version": "v1",
"id": "CVE-2024-46678-6d5de6db"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 875.0,
"function_hash": "72220186914272486990825094666672817021"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_ipsec_add_sa_all"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b598069164ac1bb60996d6ff94e7f9169dbd2d3",
"signature_version": "v1",
"id": "CVE-2024-46678-86c0229b"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 781.0,
"function_hash": "164942018493480490900114123545510316632"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_ipsec_del_sa_all"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b598069164ac1bb60996d6ff94e7f9169dbd2d3",
"signature_version": "v1",
"id": "CVE-2024-46678-9b625a00"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"163482465936904467107332995042450514571",
"64414500015769110128611119820598330475",
"253209949963840565951879162898043901594",
"166744726542585077385029133871422777798",
"316714577740949349101662776366387662188",
"25504425452309320281614721322392387009",
"117237245046752005225769001112617584073",
"24694954746311540922817965754968610887",
"137540140771168527108221870862254554006",
"24685219944789733809149942814670781631",
"330564237872877728333234494944364873601",
"213128942540270418282372206372237101035",
"160523660576899706400230476227322913976",
"115780314041032210500819222095193439764",
"100057024576420318782867536103207076586",
"92757968197317293587521795063426123564",
"215061669081550960043493072580953366103",
"51965300508085961177161193222757602387",
"275808192254485899183535312412419262638",
"278649526457687272843349846596175975814",
"72166105619486020256877756481596171988",
"281138956635363413106229209345544704115",
"153841456576654518103792032235219509177",
"219972242501073940435922310959762106344",
"47024273050928324641556441184758533214",
"169680650509392329047704152023575271116",
"290469397089993210139540366707733850937",
"69595566569884030775067231944054398979",
"30618631898907371568050691270827213705",
"239017728867424483339209674300448059741",
"206095639645102291039392997200997981412",
"97616702476705732788479363248693006919",
"107680112678896346882112381959504061328",
"85125784367392656181106503017931845127",
"24161950975540907373004562580429613662",
"20820837526976114385807465348752496383",
"121181417176207134418649065289976902320",
"298893289936822514846492538509975625486",
"252458340248782737435363766907798390044",
"133806073079968529334056520803693991293",
"213128942540270418282372206372237101035",
"57298852610691152805129955162702534377",
"275149514617421408801132079604565760236",
"168558683884527296420497499397221583474",
"333399980074741277931591488130704754695",
"30598791512160755756434491579504764683",
"169438721102927189078122900555950004039",
"107684369815990627621123168246616303702",
"115996283458703466979986452099160575312",
"209737639482525789286409705321772731733",
"141868385748307754836499005656562548071",
"86688456943243716098053501784921345240",
"133288845360298613315917868151251864480",
"81988178971126113279785688379620587254",
"41755469088531305707247392807392351079",
"336040627184803405150101750030855233313",
"208214048862664442357463500656393331374",
"178862651540277320655917143101565725387",
"60603105918137169317134513968902010810",
"25962595361291137122742635105880145355",
"14997101464432749150584045937879954249",
"203031823277226260466709722742663659870",
"92199646750663306825482143921425004500",
"283486448637378249331477608934258914978",
"64414500015769110128611119820598330475",
"253209949963840565951879162898043901594",
"166744726542585077385029133871422777798",
"277517457535854385134610868151978739474",
"2024086688536859333016431075202706393",
"233290728577767159989327761063571014927",
"249886056926896109851271906345376376551",
"129365581063915206719082480192214569751",
"125148792638339413409303604142989661789",
"143941197630162323416438351155331423262",
"206229018335926824471293711981992924489",
"229432487585745332809434314713549695125",
"10022079767131423013123487570925878739",
"46982164075915350681844969586477237831",
"18793571344502686957142466154840388917",
"195649589698911351709482174305752510096",
"89119096935669340981362405069358253596",
"199925384354917536592225404426707385541",
"20371085839641775327704898587820116078",
"79881940502583398772423459023134168600",
"85125784367392656181106503017931845127",
"24161950975540907373004562580429613662",
"165575989972794578336705055321782495683",
"242427413914625146027976742713090790937",
"300010631263276583949797999653398407883",
"71314369681005456522999718201574358929",
"292002753453060309158898440554131628575",
"181733257899408107019359109553252667003",
"228614360076972569661202102766305926986",
"86512956612700709556611072882905681897",
"170316151352743904693004120482873936813",
"275124416567411013362240606074679117096",
"89119096935669340981362405069358253596",
"199925384354917536592225404426707385541",
"165740718692048826854037769424300397388",
"133721917134797286885026742922833205254",
"105826599358565553023526261997449882557",
"35485200927816538310577667296505746265",
"148931229677929838897352663331991616295",
"200203661071042203057068126076690354522",
"313380790576351160641280927521092471384",
"176999863818730070731623807069748065584",
"184030709760166440985618761897249941817"
],
"threshold": 0.9
},
"target": {
"file": "drivers/net/bonding/bond_main.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aeeef906d5a526dc60cf4af92eda69836c39b1f",
"signature_version": "v1",
"id": "CVE-2024-46678-a829e680"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"131389781964170256706173779730043613076",
"213333545424447916799971098941091915988",
"182320529700887938257568641086176031109",
"69539523535792426342557044197721991372"
],
"threshold": 0.9
},
"target": {
"file": "include/net/bonding.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aeeef906d5a526dc60cf4af92eda69836c39b1f",
"signature_version": "v1",
"id": "CVE-2024-46678-b2239f02"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"163482465936904467107332995042450514571",
"64414500015769110128611119820598330475",
"253209949963840565951879162898043901594",
"166744726542585077385029133871422777798",
"316714577740949349101662776366387662188",
"25504425452309320281614721322392387009",
"117237245046752005225769001112617584073",
"24694954746311540922817965754968610887",
"137540140771168527108221870862254554006",
"24685219944789733809149942814670781631",
"330564237872877728333234494944364873601",
"213128942540270418282372206372237101035",
"160523660576899706400230476227322913976",
"115780314041032210500819222095193439764",
"100057024576420318782867536103207076586",
"92757968197317293587521795063426123564",
"215061669081550960043493072580953366103",
"51965300508085961177161193222757602387",
"275808192254485899183535312412419262638",
"278649526457687272843349846596175975814",
"72166105619486020256877756481596171988",
"281138956635363413106229209345544704115",
"153841456576654518103792032235219509177",
"219972242501073940435922310959762106344",
"47024273050928324641556441184758533214",
"169680650509392329047704152023575271116",
"290469397089993210139540366707733850937",
"69595566569884030775067231944054398979",
"30618631898907371568050691270827213705",
"239017728867424483339209674300448059741",
"206095639645102291039392997200997981412",
"97616702476705732788479363248693006919",
"107680112678896346882112381959504061328",
"85125784367392656181106503017931845127",
"24161950975540907373004562580429613662",
"20820837526976114385807465348752496383",
"121181417176207134418649065289976902320",
"298893289936822514846492538509975625486",
"252458340248782737435363766907798390044",
"133806073079968529334056520803693991293",
"213128942540270418282372206372237101035",
"57298852610691152805129955162702534377",
"275149514617421408801132079604565760236",
"168558683884527296420497499397221583474",
"333399980074741277931591488130704754695",
"30598791512160755756434491579504764683",
"169438721102927189078122900555950004039",
"107684369815990627621123168246616303702",
"115996283458703466979986452099160575312",
"209737639482525789286409705321772731733",
"141868385748307754836499005656562548071",
"86688456943243716098053501784921345240",
"133288845360298613315917868151251864480",
"81988178971126113279785688379620587254",
"41755469088531305707247392807392351079",
"336040627184803405150101750030855233313",
"208214048862664442357463500656393331374",
"178862651540277320655917143101565725387",
"60603105918137169317134513968902010810",
"25962595361291137122742635105880145355",
"14997101464432749150584045937879954249",
"203031823277226260466709722742663659870",
"92199646750663306825482143921425004500",
"283486448637378249331477608934258914978",
"64414500015769110128611119820598330475",
"253209949963840565951879162898043901594",
"166744726542585077385029133871422777798",
"277517457535854385134610868151978739474",
"2024086688536859333016431075202706393",
"233290728577767159989327761063571014927",
"249886056926896109851271906345376376551",
"129365581063915206719082480192214569751",
"125148792638339413409303604142989661789",
"143941197630162323416438351155331423262",
"206229018335926824471293711981992924489",
"229432487585745332809434314713549695125",
"10022079767131423013123487570925878739",
"46982164075915350681844969586477237831",
"18793571344502686957142466154840388917",
"195649589698911351709482174305752510096",
"89119096935669340981362405069358253596",
"199925384354917536592225404426707385541",
"20371085839641775327704898587820116078",
"79881940502583398772423459023134168600",
"85125784367392656181106503017931845127",
"24161950975540907373004562580429613662",
"165575989972794578336705055321782495683",
"242427413914625146027976742713090790937",
"300010631263276583949797999653398407883",
"71314369681005456522999718201574358929",
"292002753453060309158898440554131628575",
"181733257899408107019359109553252667003",
"228614360076972569661202102766305926986",
"86512956612700709556611072882905681897",
"170316151352743904693004120482873936813",
"275124416567411013362240606074679117096",
"89119096935669340981362405069358253596",
"199925384354917536592225404426707385541",
"165740718692048826854037769424300397388",
"133721917134797286885026742922833205254",
"105826599358565553023526261997449882557",
"35485200927816538310577667296505746265",
"148931229677929838897352663331991616295",
"200203661071042203057068126076690354522",
"313380790576351160641280927521092471384",
"315614506578610942600749837112132891296",
"217902757524228534947571365328725730058"
],
"threshold": 0.9
},
"target": {
"file": "drivers/net/bonding/bond_main.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b598069164ac1bb60996d6ff94e7f9169dbd2d3",
"signature_version": "v1",
"id": "CVE-2024-46678-da0c3fdd"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 848.0,
"function_hash": "194868208867400252058758636142016395694"
},
"target": {
"file": "drivers/net/bonding/bond_main.c",
"function": "bond_ipsec_del_sa"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b598069164ac1bb60996d6ff94e7f9169dbd2d3",
"signature_version": "v1",
"id": "CVE-2024-46678-dab14791"
}
]