In the Linux kernel, the following vulnerability has been resolved:
dropmonitor: replace spinlock by rawspinlock
tracedropcommon() is called with preemption disabled, and it acquires a spinlock. This is problematic for RT kernels because spinlocks are sleeping locks in this configuration, which causes the following splat:
BUG: sleeping function called from invalid context at kernel/locking/spinlockrt.c:48 inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 449, name: rcuc/47 preemptcount: 1, expected: 0 RCU nest depth: 2, expected: 2 5 locks held by rcuc/47/449: #0: ff1100086ec30a60 ((softirqctrl.lock)){+.+.}-{2:2}, at: _localbhdisableip+0x105/0x210 #1: ffffffffb394a280 (rcureadlock){....}-{1:2}, at: rtspinlock+0xbf/0x130 #2: ffffffffb394a280 (rcureadlock){....}-{1:2}, at: _localbhdisableip+0x11c/0x210 #3: ffffffffb394a160 (rcucallback){....}-{0:0}, at: rcudobatch+0x360/0xc70 #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: tracedropcommon.constprop.0+0xb5/0x290 irq event stamp: 139909 hardirqs last enabled at (139908): [<ffffffffb1df2b33>] _rawspinunlockirqrestore+0x63/0x80 hardirqs last disabled at (139909): [<ffffffffb19bd03d>] tracedropcommon.constprop.0+0x26d/0x290 softirqs last enabled at (139892): [<ffffffffb07a1083>] _localbhenableip+0x103/0x170 softirqs last disabled at (139898): [<ffffffffb0909b33>] rcucpukthread+0x93/0x1f0 Preemption disabled at: [<ffffffffb1de786b>] rtmutexslowunlock+0xab/0x2e0 CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dumpstacklvl+0x8c/0xd0 dumpstack+0x14/0x20 _mightresched+0x21e/0x2f0 rtspinlock+0x5e/0x130 ? tracedropcommon.constprop.0+0xb5/0x290 ? skbqueuepurgereason.part.0+0x1bf/0x230 tracedropcommon.constprop.0+0xb5/0x290 ? preemptcountsub+0x1c/0xd0 ? rawspinunlockirqrestore+0x4a/0x80 ? _pfxtracedropcommon.constprop.0+0x10/0x10 ? rtmutexslowunlock+0x26a/0x2e0 ? skbqueuepurgereason.part.0+0x1bf/0x230 ? _pfxrtmutexslowunlock+0x10/0x10 ? skbqueuepurgereason.part.0+0x1bf/0x230 tracekfreeskbhit+0x15/0x20 tracekfreeskb+0xe9/0x150 kfreeskbreason+0x7b/0x110 skbqueuepurgereason.part.0+0x1bf/0x230 ? _pfxskbqueuepurgereason.part.0+0x10/0x10 ? marklock.part.0+0x8a/0x520 ...
tracedropcommon() also disables interrupts, but this is a minor issue because we could easily replace it with a local_lock.
Replace the spinlock with rawspin_lock to avoid sleeping in atomic context.
[
{
"signature_version": "v1",
"id": "CVE-2024-40980-24e5fe81",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"228343386323529068990421069705556198049",
"170104196019517484602886136976880836844",
"157994442361840185824085144867374086285",
"93109029192215562213742236913488751857",
"320014782495099226374730001010160725374",
"100414925545389655386471495001795226627",
"308242943181891825943239806906119761965",
"91412781421011926550673303645164045318",
"31156282717319180507087394307146395955",
"292339889974571352121304382635517906716",
"105563818963319689145647544062178392452",
"178186499617007384191178927810819715865",
"160400653554081363481197224444633487659",
"14274401386470534997719261130763824521",
"253018870015228263940246158105439482001",
"32598202175402214586562388244232205870",
"195368514092111271785233633582198142135",
"52581050611549576958142466073707753432",
"216029388581486163266826722789048605734",
"141061398889919982883645745343749278189",
"182369998378262434688003073625990423199",
"242737221164063135788744031016422716662",
"247025902890919741079011687463247056223",
"231289191236251513576218607323247249339",
"71887410855463503209954172863428954254",
"109440006609057540663939050295687186809",
"264168299302472033354512133055729520257",
"186656499195313089481407046060995661942",
"257592500903974122795688543109277975748",
"132269208501577477536075054357079304917",
"26980704644783612378226323975950892236",
"302754117221032097627929166417947556166",
"133650970994764094348134614936387513821",
"330053718437932580991634817783605052592",
"253362102494796202643123139478090083094",
"179854454966858513897520636176303526195"
]
},
"target": {
"file": "net/core/drop_monitor.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76ce2f9125244e1708d29c1d3f9d1d50b347bda0",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-40980-343cbf55",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"228343386323529068990421069705556198049",
"170104196019517484602886136976880836844",
"157994442361840185824085144867374086285",
"93109029192215562213742236913488751857",
"320014782495099226374730001010160725374",
"100414925545389655386471495001795226627",
"308242943181891825943239806906119761965",
"91412781421011926550673303645164045318",
"31156282717319180507087394307146395955",
"292339889974571352121304382635517906716",
"105563818963319689145647544062178392452",
"178186499617007384191178927810819715865",
"160400653554081363481197224444633487659",
"14274401386470534997719261130763824521",
"253018870015228263940246158105439482001",
"32598202175402214586562388244232205870",
"319684014889551918625751490695482210322",
"280570229317659326669130202709066283021",
"216029388581486163266826722789048605734",
"141061398889919982883645745343749278189",
"182369998378262434688003073625990423199",
"242737221164063135788744031016422716662",
"247025902890919741079011687463247056223",
"231289191236251513576218607323247249339",
"71887410855463503209954172863428954254",
"109440006609057540663939050295687186809",
"264168299302472033354512133055729520257",
"186656499195313089481407046060995661942",
"257592500903974122795688543109277975748",
"132269208501577477536075054357079304917",
"26980704644783612378226323975950892236",
"302754117221032097627929166417947556166",
"133650970994764094348134614936387513821",
"330053718437932580991634817783605052592",
"253362102494796202643123139478090083094",
"179854454966858513897520636176303526195"
]
},
"target": {
"file": "net/core/drop_monitor.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96941f29ebcc1e9cbf570dc903f30374909562f5",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-40980-6731d3a4",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"228343386323529068990421069705556198049",
"170104196019517484602886136976880836844",
"157994442361840185824085144867374086285",
"93109029192215562213742236913488751857",
"320014782495099226374730001010160725374",
"100414925545389655386471495001795226627",
"308242943181891825943239806906119761965",
"91412781421011926550673303645164045318",
"31156282717319180507087394307146395955",
"292339889974571352121304382635517906716",
"105563818963319689145647544062178392452",
"178186499617007384191178927810819715865",
"160400653554081363481197224444633487659",
"14274401386470534997719261130763824521",
"253018870015228263940246158105439482001",
"32598202175402214586562388244232205870",
"195368514092111271785233633582198142135",
"52581050611549576958142466073707753432",
"216029388581486163266826722789048605734",
"141061398889919982883645745343749278189",
"182369998378262434688003073625990423199",
"242737221164063135788744031016422716662",
"247025902890919741079011687463247056223",
"231289191236251513576218607323247249339",
"71887410855463503209954172863428954254",
"109440006609057540663939050295687186809",
"264168299302472033354512133055729520257",
"186656499195313089481407046060995661942",
"257592500903974122795688543109277975748",
"132269208501577477536075054357079304917",
"26980704644783612378226323975950892236",
"302754117221032097627929166417947556166",
"133650970994764094348134614936387513821",
"330053718437932580991634817783605052592",
"253362102494796202643123139478090083094",
"179854454966858513897520636176303526195"
]
},
"target": {
"file": "net/core/drop_monitor.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f251ccef1d864790e5253386e95544420b7cd8f3",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-40980-6e58bfa3",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"228343386323529068990421069705556198049",
"170104196019517484602886136976880836844",
"157994442361840185824085144867374086285",
"93109029192215562213742236913488751857",
"320014782495099226374730001010160725374",
"100414925545389655386471495001795226627",
"308242943181891825943239806906119761965",
"91412781421011926550673303645164045318",
"31156282717319180507087394307146395955",
"292339889974571352121304382635517906716",
"105563818963319689145647544062178392452",
"178186499617007384191178927810819715865",
"160400653554081363481197224444633487659",
"14274401386470534997719261130763824521",
"253018870015228263940246158105439482001",
"32598202175402214586562388244232205870",
"195368514092111271785233633582198142135",
"52581050611549576958142466073707753432",
"216029388581486163266826722789048605734",
"141061398889919982883645745343749278189",
"182369998378262434688003073625990423199",
"242737221164063135788744031016422716662",
"247025902890919741079011687463247056223",
"231289191236251513576218607323247249339",
"71887410855463503209954172863428954254",
"109440006609057540663939050295687186809",
"264168299302472033354512133055729520257",
"186656499195313089481407046060995661942",
"257592500903974122795688543109277975748",
"132269208501577477536075054357079304917",
"26980704644783612378226323975950892236",
"302754117221032097627929166417947556166",
"133650970994764094348134614936387513821",
"330053718437932580991634817783605052592",
"253362102494796202643123139478090083094",
"179854454966858513897520636176303526195"
]
},
"target": {
"file": "net/core/drop_monitor.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1e197a665c2148ebc25fe09c53689e60afea195",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-40980-ba39ad92",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"309067182805171671016386268754818607380",
"170104196019517484602886136976880836844",
"157994442361840185824085144867374086285",
"93109029192215562213742236913488751857",
"320014782495099226374730001010160725374",
"100414925545389655386471495001795226627",
"308242943181891825943239806906119761965",
"91412781421011926550673303645164045318",
"31156282717319180507087394307146395955",
"292339889974571352121304382635517906716",
"105563818963319689145647544062178392452",
"178186499617007384191178927810819715865",
"160400653554081363481197224444633487659",
"14274401386470534997719261130763824521",
"253018870015228263940246158105439482001",
"32598202175402214586562388244232205870",
"319684014889551918625751490695482210322",
"280570229317659326669130202709066283021",
"216029388581486163266826722789048605734",
"141061398889919982883645745343749278189",
"182369998378262434688003073625990423199",
"242737221164063135788744031016422716662",
"247025902890919741079011687463247056223",
"231289191236251513576218607323247249339",
"147979192487970024890496209601783342997",
"296235637711447185041883726223303597914",
"264168299302472033354512133055729520257",
"186656499195313089481407046060995661942",
"257592500903974122795688543109277975748",
"132269208501577477536075054357079304917",
"26980704644783612378226323975950892236",
"302754117221032097627929166417947556166",
"133650970994764094348134614936387513821",
"330053718437932580991634817783605052592",
"253362102494796202643123139478090083094",
"179854454966858513897520636176303526195"
]
},
"target": {
"file": "net/core/drop_monitor.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@594e47957f3fe034645e6885393ce96c12286334",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-40980-c3797c7a",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"228343386323529068990421069705556198049",
"170104196019517484602886136976880836844",
"157994442361840185824085144867374086285",
"93109029192215562213742236913488751857",
"320014782495099226374730001010160725374",
"100414925545389655386471495001795226627",
"308242943181891825943239806906119761965",
"91412781421011926550673303645164045318",
"31156282717319180507087394307146395955",
"292339889974571352121304382635517906716",
"105563818963319689145647544062178392452",
"178186499617007384191178927810819715865",
"160400653554081363481197224444633487659",
"14274401386470534997719261130763824521",
"253018870015228263940246158105439482001",
"32598202175402214586562388244232205870",
"195368514092111271785233633582198142135",
"52581050611549576958142466073707753432",
"216029388581486163266826722789048605734",
"141061398889919982883645745343749278189",
"182369998378262434688003073625990423199",
"242737221164063135788744031016422716662",
"247025902890919741079011687463247056223",
"231289191236251513576218607323247249339",
"71887410855463503209954172863428954254",
"109440006609057540663939050295687186809",
"264168299302472033354512133055729520257",
"186656499195313089481407046060995661942",
"257592500903974122795688543109277975748",
"132269208501577477536075054357079304917",
"26980704644783612378226323975950892236",
"302754117221032097627929166417947556166",
"133650970994764094348134614936387513821",
"330053718437932580991634817783605052592",
"253362102494796202643123139478090083094",
"179854454966858513897520636176303526195"
]
},
"target": {
"file": "net/core/drop_monitor.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3722fb69468693555f531cddda5c30444726dac",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2024-40980-d58780ee",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"228343386323529068990421069705556198049",
"170104196019517484602886136976880836844",
"157994442361840185824085144867374086285",
"93109029192215562213742236913488751857",
"320014782495099226374730001010160725374",
"100414925545389655386471495001795226627",
"308242943181891825943239806906119761965",
"91412781421011926550673303645164045318",
"31156282717319180507087394307146395955",
"292339889974571352121304382635517906716",
"105563818963319689145647544062178392452",
"178186499617007384191178927810819715865",
"160400653554081363481197224444633487659",
"14274401386470534997719261130763824521",
"253018870015228263940246158105439482001",
"32598202175402214586562388244232205870",
"195368514092111271785233633582198142135",
"52581050611549576958142466073707753432",
"216029388581486163266826722789048605734",
"141061398889919982883645745343749278189",
"182369998378262434688003073625990423199",
"242737221164063135788744031016422716662",
"247025902890919741079011687463247056223",
"231289191236251513576218607323247249339",
"71887410855463503209954172863428954254",
"109440006609057540663939050295687186809",
"264168299302472033354512133055729520257",
"186656499195313089481407046060995661942",
"257592500903974122795688543109277975748",
"132269208501577477536075054357079304917",
"26980704644783612378226323975950892236",
"302754117221032097627929166417947556166",
"133650970994764094348134614936387513821",
"330053718437932580991634817783605052592",
"253362102494796202643123139478090083094",
"179854454966858513897520636176303526195"
]
},
"target": {
"file": "net/core/drop_monitor.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07ea878684dfb78a9d4f564c39d07e855a9e242e",
"signature_type": "Line"
}
]