linux-cve-announce - CVE-2024-57939: riscv: Fix sleeping in invalid context in die()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025012127-CVE-2024-57939-fb7b@gregkh>
Date: Tue, 21 Jan 2025 13:18:28 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-57939: riscv: Fix sleeping in invalid context in die()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

riscv: Fix sleeping in invalid context in die()

die() can be called in exception handler, and therefore cannot sleep.
However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled.
That causes the following warning:

BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex
preempt_count: 110001, expected: 0
RCU nest depth: 0, expected: 0
CPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
    dump_backtrace+0x1c/0x24
    show_stack+0x2c/0x38
    dump_stack_lvl+0x5a/0x72
    dump_stack+0x14/0x1c
    __might_resched+0x130/0x13a
    rt_spin_lock+0x2a/0x5c
    die+0x24/0x112
    do_trap_insn_illegal+0xa0/0xea
    _new_vmalloc_restore_context_a0+0xcc/0xd8
Oops - illegal instruction [#1]

Switch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT
enabled.

The Linux kernel CVE team has assigned CVE-2024-57939 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.15 with commit 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 and fixed in 6.1.125 with commit c21df31fc2a4afc02a6e56511364e9e793ea92ec
	Issue introduced in 4.15 with commit 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 and fixed in 6.6.72 with commit f48f060a4b36b5e96628f6c3fb1540f1e8dedb69
	Issue introduced in 4.15 with commit 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 and fixed in 6.12.10 with commit 76ab0afcdbe8c9685b589016ee1c0e25fe596707
	Issue introduced in 4.15 with commit 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 and fixed in 6.13 with commit 6a97f4118ac07cfdc316433f385dbdc12af5025e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-57939
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/riscv/kernel/traps.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c21df31fc2a4afc02a6e56511364e9e793ea92ec
	https://git.kernel.org/stable/c/f48f060a4b36b5e96628f6c3fb1540f1e8dedb69
	https://git.kernel.org/stable/c/76ab0afcdbe8c9685b589016ee1c0e25fe596707
	https://git.kernel.org/stable/c/6a97f4118ac07cfdc316433f385dbdc12af5025e