linux-cve-announce - CVE-2022-49322: tracing: Fix sleeping function called from invalid context on RT kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022637-CVE-2022-49322-b0f0@gregkh>
Date: Wed, 26 Feb 2025 03:09:56 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49322: tracing: Fix sleeping function called from invalid context on RT kernel

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix sleeping function called from invalid context on RT kernel

When setting bootparams="trace_event=initcall:initcall_start tp_printk=1" in the
cmdline, the output_printk() was called, and the spin_lock_irqsave() was called in the
atomic and irq disable interrupt context suitation. On the PREEMPT_RT kernel,
these locks are replaced with sleepable rt-spinlock, so the stack calltrace will
be triggered.
Fix it by raw_spin_lock_irqsave when PREEMPT_RT and "trace_event=initcall:initcall_start
tp_printk=1" enabled.

 BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0
 preempt_count: 2, expected: 0
 RCU nest depth: 0, expected: 0
 Preemption disabled at:
 [<ffffffff8992303e>] try_to_wake_up+0x7e/0xba0
 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.1-rt17+ #19 34c5812404187a875f32bee7977f7367f9679ea7
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0x60/0x8c
  dump_stack+0x10/0x12
  __might_resched.cold+0x11d/0x155
  rt_spin_lock+0x40/0x70
  trace_event_buffer_commit+0x2fa/0x4c0
  ? map_vsyscall+0x93/0x93
  trace_event_raw_event_initcall_start+0xbe/0x110
  ? perf_trace_initcall_finish+0x210/0x210
  ? probe_sched_wakeup+0x34/0x40
  ? ttwu_do_wakeup+0xda/0x310
  ? trace_hardirqs_on+0x35/0x170
  ? map_vsyscall+0x93/0x93
  do_one_initcall+0x217/0x3c0
  ? trace_event_raw_event_initcall_level+0x170/0x170
  ? push_cpu_stop+0x400/0x400
  ? cblist_init_generic+0x241/0x290
  kernel_init_freeable+0x1ac/0x347
  ? _raw_spin_unlock_irq+0x65/0x80
  ? rest_init+0xf0/0xf0
  kernel_init+0x1e/0x150
  ret_from_fork+0x22/0x30
  </TASK>

The Linux kernel CVE team has assigned CVE-2022-49322 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.283 with commit be1f323fb9d9b14a505ca22d742d321769454de1
	Fixed in 4.19.247 with commit 40f9fde06b25884baa0c4bd138b909a9b67218b4
	Fixed in 5.4.198 with commit 48c6ee7d6c614f09b2c8553a95eefef6ecf196e0
	Fixed in 5.10.122 with commit 1788e6dbb61286215442b1af99e51405a6206762
	Fixed in 5.15.47 with commit 9b534640a2c6a8d88168febc82ec6d161184f2ec
	Fixed in 5.17.15 with commit 43bfc4dccc416c964b53cbdc430e814f8b6f770b
	Fixed in 5.18.4 with commit 9abf3db8bdb63ab545034148ef2118f4d088ca59
	Fixed in 5.19 with commit 12025abdc8539ed9d5014e2d647a3fd1bd3de5cd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49322
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/trace/trace.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/be1f323fb9d9b14a505ca22d742d321769454de1
	https://git.kernel.org/stable/c/40f9fde06b25884baa0c4bd138b909a9b67218b4
	https://git.kernel.org/stable/c/48c6ee7d6c614f09b2c8553a95eefef6ecf196e0
	https://git.kernel.org/stable/c/1788e6dbb61286215442b1af99e51405a6206762
	https://git.kernel.org/stable/c/9b534640a2c6a8d88168febc82ec6d161184f2ec
	https://git.kernel.org/stable/c/43bfc4dccc416c964b53cbdc430e814f8b6f770b
	https://git.kernel.org/stable/c/9abf3db8bdb63ab545034148ef2118f4d088ca59
	https://git.kernel.org/stable/c/12025abdc8539ed9d5014e2d647a3fd1bd3de5cd