mirror of
https://github.com/0xMarcio/cve.git
synced 2025-11-28 18:48:49 +00:00
21 lines
4.1 KiB
Markdown
21 lines
4.1 KiB
Markdown
### [CVE-2024-56585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56585)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### Description
|
|
|
|
In the Linux kernel, the following vulnerability has been resolved:LoongArch: Fix sleeping in atomic context for PREEMPT_RTCommit bab1c299f3945ffe79 ("LoongArch: Fix sleeping in atomic context insetup_tlb_handler()") changes the gfp flag from GFP_KERNEL to GFP_ATOMICfor alloc_pages_node(). However, for PREEMPT_RT kernels we can still geta "sleeping in atomic context" error:[ 0.372259] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48[ 0.372266] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1[ 0.372268] preempt_count: 1, expected: 0[ 0.372270] RCU nest depth: 1, expected: 1[ 0.372272] 3 locks held by swapper/1/0:[ 0.372274] #0: 900000000c9f5e60 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x524/0x1c60[ 0.372294] #1: 90000000087013b8 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x50/0x140[ 0.372305] #2: 900000047fffd388 (&zone->lock){+.+.}-{3:3}, at: __rmqueue_pcplist+0x30c/0xea0[ 0.372314] irq event stamp: 0[ 0.372316] hardirqs last enabled at (0): [<0000000000000000>] 0x0[ 0.372322] hardirqs last disabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0[ 0.372329] softirqs last enabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0[ 0.372335] softirqs last disabled at (0): [<0000000000000000>] 0x0[ 0.372341] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7+ #1891[ 0.372346] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022[ 0.372349] Stack : 0000000000000089 9000000005a0db9c 90000000071519c8 9000000100388000[ 0.372486] 900000010038b890 0000000000000000 900000010038b898 9000000007e53788[ 0.372492] 900000000815bcc8 900000000815bcc0 900000010038b700 0000000000000001[ 0.372498] 0000000000000001 4b031894b9d6b725 00000000055ec000 9000000100338fc0[ 0.372503] 00000000000000c4 0000000000000001 000000000000002d 0000000000000003[ 0.372509] 0000000000000030 0000000000000003 00000000055ec000 0000000000000003[ 0.372515] 900000000806d000 9000000007e53788 00000000000000b0 0000000000000004[ 0.372521] 0000000000000000 0000000000000000 900000000c9f5f10 0000000000000000[ 0.372526] 90000000076f12d8 9000000007e53788 9000000005924778 0000000000000000[ 0.372532] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000[ 0.372537] ...[ 0.372540] Call Trace:[ 0.372542] [<9000000005924778>] show_stack+0x38/0x180[ 0.372548] [<90000000071519c4>] dump_stack_lvl+0x94/0xe4[ 0.372555] [<900000000599b880>] __might_resched+0x1a0/0x260[ 0.372561] [<90000000071675cc>] rt_spin_lock+0x4c/0x140[ 0.372565] [<9000000005cbb768>] __rmqueue_pcplist+0x308/0xea0[ 0.372570] [<9000000005cbed84>] get_page_from_freelist+0x564/0x1c60[ 0.372575] [<9000000005cc0d98>] __alloc_pages_noprof+0x218/0x1820[ 0.372580] [<900000000593b36c>] tlb_init+0x1ac/0x298[ 0.372585] [<9000000005924b74>] per_cpu_trap_init+0x114/0x140[ 0.372589] [<9000000005921964>] cpu_probe+0x4e4/0xa60[ 0.372592] [<9000000005934874>] start_secondary+0x34/0xc0[ 0.372599] [<900000000715615c>] smpboot_entry+0x64/0x6cThis is because in PREEMPT_RT kernels normal spinlocks are replaced byrt spinlocks and rt_spin_lock() will cause sleeping. Fix it by disablingNUMA optimization completely for PREEMPT_RT kernels.
|
|
|
|
### POC
|
|
|
|
#### Reference
|
|
No PoCs from references.
|
|
|
|
#### Github
|
|
- https://github.com/cku-heise/euvd-api-doc
|
|
- https://github.com/w4zu/Debian_security
|
|
|