linux-cve-announce - CVE-2025-21767: clocksource: Use migrate_disable() to avoid calling get_random

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022605-CVE-2025-21767-4c7f@gregkh>
Date: Wed, 26 Feb 2025 18:17:23 -0800
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21767: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context

The following bug report happened with a PREEMPT_RT kernel:

  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog
  preempt_count: 1, expected: 0
  RCU nest depth: 0, expected: 0
  get_random_u32+0x4f/0x110
  clocksource_verify_choose_cpus+0xab/0x1a0
  clocksource_verify_percpu.part.0+0x6b/0x330
  clocksource_watchdog_kthread+0x193/0x1a0

It is due to the fact that clocksource_verify_choose_cpus() is invoked with
preemption disabled.  This function invokes get_random_u32() to obtain
random numbers for choosing CPUs.  The batched_entropy_32 local lock and/or
the base_crng.lock spinlock in driver/char/random.c will be acquired during
the call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot
be acquired in atomic context.

Fix this problem by using migrate_disable() to allow smp_processor_id() to
be reliably used without introducing atomic context. preempt_disable() is
then called after clocksource_verify_choose_cpus() but before the
clocksource measurement is being run to avoid introducing unexpected
latency.

The Linux kernel CVE team has assigned CVE-2025-21767 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit 7560c02bdffb7c52d1457fa551b9e745d4b9e754 and fixed in 6.1.129 with commit 852805b6cbdb69c298a8fc9fbe79994c95106e04
	Issue introduced in 5.14 with commit 7560c02bdffb7c52d1457fa551b9e745d4b9e754 and fixed in 6.6.79 with commit 8783ceeee797d9aa9cfe150690fb9d0bac8cc459
	Issue introduced in 5.14 with commit 7560c02bdffb7c52d1457fa551b9e745d4b9e754 and fixed in 6.12.16 with commit cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa
	Issue introduced in 5.14 with commit 7560c02bdffb7c52d1457fa551b9e745d4b9e754 and fixed in 6.13.4 with commit 0fb534187d2355f6c8f995321e76d1ccd1262ac1
	Issue introduced in 5.14 with commit 7560c02bdffb7c52d1457fa551b9e745d4b9e754 and fixed in 6.14-rc2 with commit 6bb05a33337b2c842373857b63de5c9bf1ae2a09
	Issue introduced in 5.10.50 with commit d9b40ebd448e437ffbc65f013836f98252279a82
	Issue introduced in 5.12.17 with commit 193e14e68e907b2a7a936a7726accbaa4df25a4d
	Issue introduced in 5.13.2 with commit 155d3c5d24ee13cafa6236b49fc02b240a511d59

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21767
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/time/clocksource.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/852805b6cbdb69c298a8fc9fbe79994c95106e04
	https://git.kernel.org/stable/c/8783ceeee797d9aa9cfe150690fb9d0bac8cc459
	https://git.kernel.org/stable/c/cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa
	https://git.kernel.org/stable/c/0fb534187d2355f6c8f995321e76d1ccd1262ac1
	https://git.kernel.org/stable/c/6bb05a33337b2c842373857b63de5c9bf1ae2a09