In the Linux kernel, the following vulnerability has been resolved:
sched/core: Prevent rescheduling when interrupts are disabled
David reported a warning observed while loop testing kexec jump:
Interrupts enabled after irqrouterresume+0x0/0x50 WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscoreresume+0x18a/0x220 kernelkexec+0xf6/0x180 _dosysreboot+0x206/0x250 dosyscall64+0x95/0x180
The corresponding interrupt flag trace:
hardirqs last enabled at (15573): [<ffffffffa8281b8e>] _upconsolesem+0x7e/0x90 hardirqs last disabled at (15580): [<ffffffffa8281b73>] _upconsolesem+0x63/0x90
That means _upconsolesem() was invoked with interrupts enabled. Further instrumentation revealed that in the interrupt disabled section of kexec jump one of the syscoresuspend() callbacks woke up a task, which set the NEEDRESCHED flag. A later callback in the resume path invoked condresched() which in turn led to the invocation of the scheduler:
_condresched+0x21/0x60 downtimeout+0x18/0x60 acpioswaitsemaphore+0x4c/0x80 acpiutacquiremutex+0x3d/0x100 acpinsgetnode+0x27/0x60 acpinsevaluate+0x1cb/0x2d0 acpirssetsrsmethoddata+0x156/0x190 acpipcilinkset+0x11c/0x290 irqrouterresume+0x54/0x60 syscoreresume+0x6a/0x200 kernelkexec+0x145/0x1c0 _dosysreboot+0xeb/0x240 dosyscall64+0x95/0x180
This is a long standing problem, which probably got more visible with the recent printk changes. Something does a task wakeup and the scheduler sets the NEEDRESCHED flag. condresched() sees it set and invokes schedule() from a completely bogus context. The scheduler enables interrupts after context switching, which causes the above warning at the end.
Quite some of the code paths in syscore_suspend()/resume() can result in triggering a wakeup with the exactly same consequences. They might not have done so yet, but as they share a lot of code with normal operations it's just a question of time.
The problem only affects the PREEMPTNONE and PREEMPTVOLUNTARY scheduling models. Full preemption is not affected as cond_resched() is disabled and the preemption check preemptible() takes the interrupt disabled flag into account.
Cure the problem by adding a corresponding check into cond_resched().
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"251938152659959979806175007209078119380",
"22480559956959132976757629830389612753",
"249180333393894475511131953667217054258",
"170358374837891121111896140350634716960"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84586322e010164eedddfcd0a0894206ae7d9317",
"signature_version": "v1",
"id": "CVE-2024-58090-024249a3"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"251938152659959979806175007209078119380",
"22480559956959132976757629830389612753",
"249180333393894475511131953667217054258",
"170358374837891121111896140350634716960"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c387ef7568c0d96a918a5a78d9cad6256cfa15",
"signature_version": "v1",
"id": "CVE-2024-58090-163f28fa"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"251938152659959979806175007209078119380",
"22480559956959132976757629830389612753",
"249180333393894475511131953667217054258",
"170358374837891121111896140350634716960"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0362847c520747b44b574d363705d8af0621727a",
"signature_version": "v1",
"id": "CVE-2024-58090-1e0a9801"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"66391467666948826161186199825485214512",
"135059405124417276122436665983214375224",
"249180333393894475511131953667217054258",
"170358374837891121111896140350634716960"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@321794b75ac968f0bb6b9c913581949452a8d992",
"signature_version": "v1",
"id": "CVE-2024-58090-2866731d"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"251938152659959979806175007209078119380",
"22480559956959132976757629830389612753",
"249180333393894475511131953667217054258",
"170358374837891121111896140350634716960"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68786ab0935ccd5721283b7eb7f4d2f2942c7a52",
"signature_version": "v1",
"id": "CVE-2024-58090-64a1a83b"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 106.0,
"function_hash": "115626816708541568675192613107125227277"
},
"target": {
"file": "kernel/sched/core.c",
"function": "_cond_resched"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1651f5731b378616565534eb9cda30e258cebebc",
"signature_version": "v1",
"id": "CVE-2024-58090-699554a8"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"251938152659959979806175007209078119380",
"22480559956959132976757629830389612753",
"249180333393894475511131953667217054258",
"170358374837891121111896140350634716960"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b927c8539f692fb1f9c2f42e6c8ea2d94956f921",
"signature_version": "v1",
"id": "CVE-2024-58090-6aa5787d"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 142.0,
"function_hash": "247373889297164249755354396805965746851"
},
"target": {
"file": "kernel/sched/core.c",
"function": "__cond_resched"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@288fdb8dcb71ec77b76ab8b8a06bc10f595ea504",
"signature_version": "v1",
"id": "CVE-2024-58090-73a239a2"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 142.0,
"function_hash": "247373889297164249755354396805965746851"
},
"target": {
"file": "kernel/sched/core.c",
"function": "__cond_resched"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68786ab0935ccd5721283b7eb7f4d2f2942c7a52",
"signature_version": "v1",
"id": "CVE-2024-58090-86dd1efe"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 142.0,
"function_hash": "247373889297164249755354396805965746851"
},
"target": {
"file": "kernel/sched/core.c",
"function": "__cond_resched"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84586322e010164eedddfcd0a0894206ae7d9317",
"signature_version": "v1",
"id": "CVE-2024-58090-8e0adb68"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 142.0,
"function_hash": "247373889297164249755354396805965746851"
},
"target": {
"file": "kernel/sched/core.c",
"function": "__cond_resched"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c387ef7568c0d96a918a5a78d9cad6256cfa15",
"signature_version": "v1",
"id": "CVE-2024-58090-8f41afcb"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 142.0,
"function_hash": "247373889297164249755354396805965746851"
},
"target": {
"file": "kernel/sched/core.c",
"function": "__cond_resched"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0362847c520747b44b574d363705d8af0621727a",
"signature_version": "v1",
"id": "CVE-2024-58090-94c1dc65"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 142.0,
"function_hash": "247373889297164249755354396805965746851"
},
"target": {
"file": "kernel/sched/core.c",
"function": "__cond_resched"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b927c8539f692fb1f9c2f42e6c8ea2d94956f921",
"signature_version": "v1",
"id": "CVE-2024-58090-ab9788ad"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"251938152659959979806175007209078119380",
"22480559956959132976757629830389612753",
"249180333393894475511131953667217054258",
"170358374837891121111896140350634716960"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@288fdb8dcb71ec77b76ab8b8a06bc10f595ea504",
"signature_version": "v1",
"id": "CVE-2024-58090-c7a606bf"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"66391467666948826161186199825485214512",
"135059405124417276122436665983214375224",
"249180333393894475511131953667217054258",
"170358374837891121111896140350634716960"
],
"threshold": 0.9
},
"target": {
"file": "kernel/sched/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1651f5731b378616565534eb9cda30e258cebebc",
"signature_version": "v1",
"id": "CVE-2024-58090-e001478d"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 106.0,
"function_hash": "115626816708541568675192613107125227277"
},
"target": {
"file": "kernel/sched/core.c",
"function": "_cond_resched"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@321794b75ac968f0bb6b9c913581949452a8d992",
"signature_version": "v1",
"id": "CVE-2024-58090-ff7e47fa"
}
]