CVE-2024-35991

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-35991
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35991.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-35991
Downstream
Related
Published
2024-05-20T09:47:56Z
Modified
2025-10-17T06:02:47.993306Z
Summary
dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
Details

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue

drainworkqueue() cannot be called safely in a spinlocked context due to possible task rescheduling. In the multi-task scenario, calling queuework() while drainworkqueue() will lead to a Call Trace as pushing a work on a draining workqueue is not permitted in spinlocked context. Call Trace: <TASK> ? _warn+0x7d/0x140 ? _queuework+0x2b2/0x440 ? reportbug+0x1f8/0x200 ? handlebug+0x3c/0x70 ? excinvalidop+0x18/0x70 ? asmexcinvalidop+0x1a/0x20 ? _queuework+0x2b2/0x440 queueworkon+0x28/0x30 idxdmiscthread+0x303/0x5a0 [idxd] ? _schedule+0x369/0xb40 ? _pfxirqthreadfn+0x10/0x10 ? irqthread+0xbc/0x1b0 irqthreadfn+0x21/0x70 irqthread+0x102/0x1b0 ? preemptcountadd+0x74/0xa0 ? _pfxirqthreaddtor+0x10/0x10 ? _pfxirqthread+0x10/0x10 kthread+0x103/0x140 ? _pfxkthread+0x10/0x10 retfromfork+0x31/0x50 ? _pfxkthread+0x10/0x10 retfromforkasm+0x1b/0x30 </TASK>

The current implementation uses a spinlock to protect event log workqueue and will lead to the Call Trace due to potential task rescheduling.

To address the locking issue, convert the spinlock to mutex, allowing the drain_workqueue() to be called in a safe mutex-locked context.

This change ensures proper synchronization when accessing the event log workqueue, preventing potential Call Trace and improving the overall robustness of the code.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c40bd7d9737bdcfb02d42765bc6c59b338151123
Fixed
758071a35d9f3ffd84ff12169d081412a2f5f098
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c40bd7d9737bdcfb02d42765bc6c59b338151123
Fixed
c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c40bd7d9737bdcfb02d42765bc6c59b338151123
Fixed
d5638de827cff0fce77007e426ec0ffdedf68a44

Affected versions

v6.*

v6.3
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.8.6
v6.8.7
v6.8.8
v6.9-rc1

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.30
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.8.9