linux-cve-announce - CVE-2022-50504: powerpc/rtas: avoid scheduling in rtas_os

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100422-CVE-2022-50504-d655@gregkh>
Date: Sat,  4 Oct 2025 17:51:29 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50504: powerpc/rtas: avoid scheduling in rtas_os_term()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: avoid scheduling in rtas_os_term()

It's unsafe to use rtas_busy_delay() to handle a busy status from
the ibm,os-term RTAS function in rtas_os_term():

Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0
preempt_count: 2, expected: 0
CPU: 7 PID: 1 Comm: swapper/0 Tainted: G      D            6.0.0-rc5-02182-gf8553a572277-dirty #9
Call Trace:
[c000000007b8f000] [c000000001337110] dump_stack_lvl+0xb4/0x110 (unreliable)
[c000000007b8f040] [c0000000002440e4] __might_resched+0x394/0x3c0
[c000000007b8f0e0] [c00000000004f680] rtas_busy_delay+0x120/0x1b0
[c000000007b8f100] [c000000000052d04] rtas_os_term+0xb8/0xf4
[c000000007b8f180] [c0000000001150fc] pseries_panic+0x50/0x68
[c000000007b8f1f0] [c000000000036354] ppc_panic_platform_handler+0x34/0x50
[c000000007b8f210] [c0000000002303c4] notifier_call_chain+0xd4/0x1c0
[c000000007b8f2b0] [c0000000002306cc] atomic_notifier_call_chain+0xac/0x1c0
[c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0
[c000000007b8f390] [c0000000001e573c] do_exit+0x140c/0x1420
[c000000007b8f480] [c0000000001e586c] make_task_dead+0xdc/0x200

Use rtas_busy_delay_time() instead, which signals without side effects
whether to attempt the ibm,os-term RTAS call again.

The Linux kernel CVE team has assigned CVE-2022-50504 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.337 with commit f413135b337c4e90c1e593c6613f8717e17bc724
	Fixed in 4.14.303 with commit 4768935b8cc2d2afeb7956292df0f6e2c49ca0a5
	Fixed in 4.19.270 with commit ffa991a003abb4f8cb9e5004646bfe2d9a46912c
	Fixed in 5.4.229 with commit 515959eb49e6d218a46979d66f36fdef329ac7d2
	Fixed in 5.10.163 with commit 6f7e2fcab73372a371ab4017cbedf7a71f4f9b40
	Fixed in 5.15.87 with commit 7280fdb80bf0fe35d9b799fc7009f2cbe0a397d7
	Fixed in 6.0.17 with commit bed48651c87bef59ea1a9d6dbc381bcbc452f4ff
	Fixed in 6.1.3 with commit 482d990a5dd1027ee0b70a8a570d56749cac8103
	Fixed in 6.2 with commit 6c606e57eecc37d6b36d732b1ff7e55b7dc32dd4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50504
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/powerpc/kernel/rtas.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f413135b337c4e90c1e593c6613f8717e17bc724
	https://git.kernel.org/stable/c/4768935b8cc2d2afeb7956292df0f6e2c49ca0a5
	https://git.kernel.org/stable/c/ffa991a003abb4f8cb9e5004646bfe2d9a46912c
	https://git.kernel.org/stable/c/515959eb49e6d218a46979d66f36fdef329ac7d2
	https://git.kernel.org/stable/c/6f7e2fcab73372a371ab4017cbedf7a71f4f9b40
	https://git.kernel.org/stable/c/7280fdb80bf0fe35d9b799fc7009f2cbe0a397d7
	https://git.kernel.org/stable/c/bed48651c87bef59ea1a9d6dbc381bcbc452f4ff
	https://git.kernel.org/stable/c/482d990a5dd1027ee0b70a8a570d56749cac8103
	https://git.kernel.org/stable/c/6c606e57eecc37d6b36d732b1ff7e55b7dc32dd4