In the Linux kernel, the following vulnerability has been resolved:
srcu: Delegate work to the boot cpu if using SRCUSIZESMALL
Commit 994f706872e6 ("srcu: Make Tree SRCU able to operate without snp_node array") assumes that cpu 0 is always online. However, there really are situations when some other CPU is the boot CPU, for example, when booting a kdump kernel with the maxcpus=1 boot parameter.
On PowerPC, the kdump kernel can hang as follows: ... [ 243.686240] INFO: task systemd:1 blocked for more than 122 seconds. [ 243.686264] Not tainted 6.1.0-rc1 #1 [ 243.686272] "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. [ 243.686281] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000 [ 243.686296] Call Trace: [ 243.686301] [c000000016657640] [c000000016657670] 0xc000000016657670 (unreliable) [ 243.686317] [c000000016657830] [c00000001001dec0] _switchto+0x130/0x220 [ 243.686333] [c000000016657890] [c000000010f607b8] _schedule+0x1f8/0x580 [ 243.686347] [c000000016657940] [c000000010f60bb4] schedule+0x74/0x140 [ 243.686361] [c0000000166579b0] [c000000010f699b8] scheduletimeout+0x168/0x1c0 [ 243.686374] [c000000016657a80] [c000000010f61de8] _waitforcommon+0x148/0x360 [ 243.686387] [c000000016657b20] [c000000010176bb0] _flushwork.isra.0+0x1c0/0x3d0 [ 243.686401] [c000000016657bb0] [c0000000105f2768] fsnotifywaitmarksdestroyed+0x28/0x40 [ 243.686415] [c000000016657bd0] [c0000000105f21b8] fsnotifydestroygroup+0x68/0x160 [ 243.686428] [c000000016657c40] [c0000000105f6500] inotifyrelease+0x30/0xa0 [ 243.686440] [c000000016657cb0] [c0000000105751a8] _fput+0xc8/0x350 [ 243.686452] [c000000016657d00] [c00000001017d524] taskworkrun+0xe4/0x170 [ 243.686464] [c000000016657d50] [c000000010020e94] donotifyresume+0x134/0x140 [ 243.686478] [c000000016657d80] [c00000001002eb18] interruptexituserpreparemain+0x198/0x270 [ 243.686493] [c000000016657de0] [c00000001002ec60] syscallexitprepare+0x70/0x180 [ 243.686505] [c000000016657e10] [c00000001000bf7c] systemcallvectoredcommon+0xfc/0x280 [ 243.686520] --- interrupt: 3000 at 0x7fffa47d5ba4 [ 243.686528] NIP: 00007fffa47d5ba4 LR: 0000000000000000 CTR: 0000000000000000 [ 243.686538] REGS: c000000016657e80 TRAP: 3000 Not tainted (6.1.0-rc1) [ 243.686548] MSR: 800000000000d033 <SF,EE,PR,ME,IR,DR,RI,LE> CR: 42044440 XER: 00000000 [ 243.686572] IRQMASK: 0 [ 243.686572] GPR00: 0000000000000006 00007ffffa606710 00007fffa48e7200 0000000000000000 [ 243.686572] GPR04: 0000000000000002 000000000000000a 0000000000000000 0000000000000001 [ 243.686572] GPR08: 000001000c172dd0 0000000000000000 0000000000000000 0000000000000000 [ 243.686572] GPR12: 0000000000000000 00007fffa4ff4bc0 0000000000000000 0000000000000000 [ 243.686572] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 243.686572] GPR20: 0000000132dfdc50 000000000000000e 0000000000189375 0000000000000000 [ 243.686572] GPR24: 00007ffffa606ae0 0000000000000005 000001000c185490 000001000c172570 [ 243.686572] GPR28: 000001000c172990 000001000c184850 000001000c172e00 00007fffa4fedd98 [ 243.686683] NIP [00007fffa47d5ba4] 0x7fffa47d5ba4 [ 243.686691] LR [0000000000000000] 0x0 [ 243.686698] --- interrupt: 3000 [ 243.686708] INFO: task kworker/u16:1:24 blocked for more than 122 seconds. [ 243.686717] Not tainted 6.1.0-rc1 #1 [ 243.686724] "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. [ 243.686733] task:kworker/u16:1 state:D stack:0 pid:24 ppid:2 flags:0x00000800 [ 243.686747] Workqueue: eventsunbound fsnotifymarkdestroyworkfn [ 243.686758] Call Trace: [ 243.686762] [c0000000166736e0] [c00000004fd91000] 0xc00000004fd91000 (unreliable) [ 243.686775] [c0000000166738d0] [c00000001001dec0] _switchto+0x130/0x220 [ 243.686788] [c000000016673930] [c000000010f607b8] _schedule+0x1f8/0x ---truncated---
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53671.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53671.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c4d26dad76eadaa45a24543e311e9ce5d09f04e",
"id": "CVE-2023-53671-1f3f64eb",
"target": {
"file": "kernel/rcu/srcutree.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"50700045851868036229178505953561218840",
"213380561755700926607740241348962077492",
"281890591997105657624752497055644405212",
"235612001366161401263879508884607337755",
"164213461073355235723460389727269780684",
"81018718605539639077381509450613918582",
"46076781702064180469352593702660374942",
"79721283429366749430821740345817557243",
"88929798194319230729208610347414440057",
"173039044709328542041355114060944582262",
"239189379329535004656056973083573356278",
"331761081891241410609220363615163801241",
"135250394891310758028721621220877023711",
"258159946431009953452763337057940058491",
"171117199482157383939161647724541106761",
"2445409383567594133881166611031341854"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-53671-277c4ab0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c4d26dad76eadaa45a24543e311e9ce5d09f04e",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_end"
},
"signature_version": "v1",
"digest": {
"function_hash": "281833149649790919821665333600928451685",
"length": 2462.0
},
"deprecated": false,
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f24626d6dd844bfc6d1f492d214d29c86d02550",
"id": "CVE-2023-53671-356aa149",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_barrier"
},
"digest": {
"function_hash": "24291696223189515028969471937594386851",
"length": 976.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c0bc03fa44942fe0fdc5ac52cda6e11529c0ea",
"id": "CVE-2023-53671-373fcb4f",
"target": {
"file": "kernel/rcu/srcutree.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"50700045851868036229178505953561218840",
"213380561755700926607740241348962077492",
"281890591997105657624752497055644405212",
"235612001366161401263879508884607337755",
"164213461073355235723460389727269780684",
"81018718605539639077381509450613918582",
"46076781702064180469352593702660374942",
"79721283429366749430821740345817557243",
"159727459618795222229849829847745800421",
"173039044709328542041355114060944582262",
"239189379329535004656056973083573356278",
"331761081891241410609220363615163801241",
"145306477041018833640776624209731530610",
"253425851077167335247347735071828677250",
"171117199482157383939161647724541106761",
"2445409383567594133881166611031341854"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-53671-57687c66",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c4d26dad76eadaa45a24543e311e9ce5d09f04e",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_start_if_needed"
},
"digest": {
"function_hash": "268305384360030146185509017261594610849",
"length": 1143.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f24626d6dd844bfc6d1f492d214d29c86d02550",
"id": "CVE-2023-53671-58101e9e",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_start_if_needed"
},
"digest": {
"function_hash": "268305384360030146185509017261594610849",
"length": 1143.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-53671-75365940",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c0bc03fa44942fe0fdc5ac52cda6e11529c0ea",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_barrier"
},
"digest": {
"function_hash": "24291696223189515028969471937594386851",
"length": 976.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-53671-8b1d1fa0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c0bc03fa44942fe0fdc5ac52cda6e11529c0ea",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_start_if_needed"
},
"digest": {
"function_hash": "268305384360030146185509017261594610849",
"length": 1143.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-53671-9e87f588",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c0bc03fa44942fe0fdc5ac52cda6e11529c0ea",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_start"
},
"digest": {
"function_hash": "153442655958122767760367054760794274259",
"length": 760.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-53671-a3c5ee9c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f24626d6dd844bfc6d1f492d214d29c86d02550",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_end"
},
"digest": {
"function_hash": "281833149649790919821665333600928451685",
"length": 2462.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-53671-a6b3ec18",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f24626d6dd844bfc6d1f492d214d29c86d02550",
"target": {
"file": "kernel/rcu/srcutree.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"50700045851868036229178505953561218840",
"213380561755700926607740241348962077492",
"281890591997105657624752497055644405212",
"235612001366161401263879508884607337755",
"164213461073355235723460389727269780684",
"81018718605539639077381509450613918582",
"46076781702064180469352593702660374942",
"79721283429366749430821740345817557243",
"159727459618795222229849829847745800421",
"173039044709328542041355114060944582262",
"239189379329535004656056973083573356278",
"331761081891241410609220363615163801241",
"145306477041018833640776624209731530610",
"253425851077167335247347735071828677250",
"171117199482157383939161647724541106761",
"2445409383567594133881166611031341854"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c4d26dad76eadaa45a24543e311e9ce5d09f04e",
"id": "CVE-2023-53671-c13a2e6d",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_start"
},
"digest": {
"function_hash": "153442655958122767760367054760794274259",
"length": 760.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-53671-c1f416f0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f24626d6dd844bfc6d1f492d214d29c86d02550",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_start"
},
"signature_version": "v1",
"digest": {
"function_hash": "153442655958122767760367054760794274259",
"length": 760.0
},
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-53671-d18931d8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c4d26dad76eadaa45a24543e311e9ce5d09f04e",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_barrier"
},
"digest": {
"function_hash": "24291696223189515028969471937594386851",
"length": 976.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-53671-f61657a4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c0bc03fa44942fe0fdc5ac52cda6e11529c0ea",
"target": {
"file": "kernel/rcu/srcutree.c",
"function": "srcu_gp_end"
},
"signature_version": "v1",
"digest": {
"function_hash": "281833149649790919821665333600928451685",
"length": 2462.0
},
"deprecated": false,
"signature_type": "Function"
}
]