In the Linux kernel, the following vulnerability has been resolved:
schedext: Fix invalid irq restore in scxops_bypass()
While adding outer irqsave/restore locking, 0e7ffff1b811 ("scx: Fix raciness in scxopsbypass()") forgot to convert an inner rqunlockirqrestore() to rq_unlock() which could re-enable IRQ prematurely leading to the following warning:
rawlocalirqrestore() called with IRQs enabled WARNING: CPU: 1 PID: 96 at kernel/locking/irqflag-debug.c:10 warnbogusirqrestore+0x30/0x40 ... Schedext: createdsq (enabling) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : warnbogusirqrestore+0x30/0x40 lr : warnbogusirqrestore+0x30/0x40 ... Call trace: warnbogusirqrestore+0x30/0x40 (P) warnbogusirqrestore+0x30/0x40 (L) scxopsbypass+0x224/0x3b8 scxopsenable.isra.0+0x2c8/0xaa8 bpfscxreg+0x18/0x30 ... irq event stamp: 33739 hardirqs last enabled at (33739): [<ffff8000800b699c>] scxopsbypass+0x174/0x3b8 hardirqs last disabled at (33738): [<ffff800080d48ad4>] rawspinlockirqsave+0xb4/0xd8
Drop the stray _irqrestore().