In the Linux kernel, the following vulnerability has been resolved:
sched/deadline: Fix warning in migrate_enable for boosted tasks
When running the following command:
while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done
a warning is eventually triggered:
WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setupnewdlentity+0x13e/0x180 ... Call Trace: <TASK> ? showtraceloglvl+0x1c4/0x2df ? enqueuedlentity+0x631/0x6e0 ? setupnewdlentity+0x13e/0x180 ? _warn+0x7e/0xd0 ? reportbug+0x11a/0x1a0 ? handlebug+0x3c/0x70 ? excinvalidop+0x14/0x70 ? asmexcinvalidop+0x16/0x20 enqueuedlentity+0x631/0x6e0 enqueuetaskdl+0x7d/0x120 _dosetcpusallowed+0xe3/0x280 _setcpusallowedptrlocked+0x140/0x1d0 _setcpusallowedptr+0x54/0xa0 migrateenable+0x7e/0x150 rtspinunlock+0x1c/0x90 groupsendsiginfo+0xf7/0x1a0 ? killpidinfo+0x1f/0x1d0 killpidinfo+0x78/0x1d0 killprocinfo+0x5b/0x110 _x64syskill+0x93/0xc0 dosyscall64+0x5c/0xf0 entrySYSCALL64after_hwframe+0x6e/0x76 RIP: 0033:0x7f0dab31f92b
This warning occurs because setcpusallowed dequeues and enqueues tasks with the ENQUEUERESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rtmutexsetprio, and a new call to setupnewdlentity is unnecessary, hence the WARN_ON call.
Check if we are requeueing a boosted task and avoid calling setupnewdl_entity if that's the case.
[
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0664e2c311b9fa43b33e3e81429cd0c2d7f9c638",
"signature_version": "v1",
"id": "CVE-2024-56583-5d8d78aa",
"digest": {
"function_hash": "33016328076333900759639214739774635273",
"length": 1011.0
},
"target": {
"file": "kernel/sched/deadline.c",
"function": "enqueue_dl_entity"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0664e2c311b9fa43b33e3e81429cd0c2d7f9c638",
"signature_version": "v1",
"id": "CVE-2024-56583-fc5395aa",
"digest": {
"line_hashes": [
"187827315768706319226021960676097380471",
"31708116595407461714901180934907317935",
"210327891289393870340059964325578610916",
"228149813258208337012241827125480559342"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/deadline.c"
}
}
]