CVE-2023-53067

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Only call gettimerirq() once in constantclockeventinit()

Under CONFIGDEBUGATOMICSLEEP=y and CONFIGDEBUGPREEMPT=y, we can see the following messages on LoongArch, this is because using mightsleep() in preemption disable context.

[ 0.001127] smp: Bringing up secondary CPUs ... [ 0.001222] Booting CPU#1... [ 0.001244] 64-bit Loongson Processor probed (LA464 Core) [ 0.001247] CPU1 revision is: 0014c012 (Loongson-64bit) [ 0.001250] FPU1 revision is: 00000000 [ 0.001252] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 [ 0.001255] inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 0, name: swapper/1 [ 0.001257] preemptcount: 1, expected: 0 [ 0.001258] RCU nest depth: 0, expected: 0 [ 0.001259] Preemption disabled at: [ 0.001261] [<9000000000223800>] archduptaskstruct+0x20/0x110 [ 0.001272] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc7+ #43 [ 0.001275] Hardware name: Loongson Loongson-3A5000-7A1000-1w-A2101/Loongson-LS3A5000-7A1000-1w-A2101, BIOS vUDK2018-LoongArch-V4.0.05132-beta10 12/13/202 [ 0.001277] Stack : 0072617764726148 0000000000000000 9000000000222f1c 90000001001e0000 [ 0.001286] 90000001001e3be0 90000001001e3be8 0000000000000000 0000000000000000 [ 0.001292] 90000001001e3be8 0000000000000040 90000001001e3cb8 90000001001e3a50 [ 0.001297] 9000000001642000 90000001001e3be8 be694d10ce4139dd 9000000100174500 [ 0.001303] 0000000000000001 0000000000000001 00000000ffffe0a2 0000000000000020 [ 0.001309] 000000000000002f 9000000001354116 00000000056b0000 ffffffffffffffff [ 0.001314] 0000000000000000 0000000000000000 90000000014f6e90 9000000001642000 [ 0.001320] 900000000022b69c 0000000000000001 0000000000000000 9000000001736a90 [ 0.001325] 9000000100038000 0000000000000000 9000000000222f34 0000000000000000 [ 0.001331] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 [ 0.001337] ... [ 0.001339] Call Trace: [ 0.001342] [<9000000000222f34>] showstack+0x5c/0x180 [ 0.001346] [<90000000010bdd80>] dumpstacklvl+0x60/0x88 [ 0.001352] [<9000000000266418>] _mightresched+0x180/0x1cc [ 0.001356] [<90000000010c742c>] mutexlock+0x20/0x64 [ 0.001359] [<90000000002a8ccc>] irqfindmatchingfwspec+0x48/0x124 [ 0.001364] [<90000000002259c4>] constantclockeventinit+0x68/0x204 [ 0.001368] [<900000000022acf4>] startsecondary+0x40/0xa8 [ 0.001371] [<90000000010c0124>] smpbootentry+0x60/0x64

Here are the complete call chains:

smpbootentry() startsecondary() constantclockeventinit() gettimerirq() irqfindmatchingfwnode() irqfindmatchingfwspec() mutexlock() mightsleep() _mightsleep() _mightresched()

In order to avoid the above issue, we should break the call chains, using timerirqinstalled variable as check condition to only call gettimerirq() once in constantclockeventinit() is a simple and proper way.