CVE: CVE-2024-26768
Published: 2024-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]

With default config, the value of NR_CPUS is 64. When HW platform has
more then 64 cpus, system will crash on these platforms. MAX_CORE_PIC
is the maximum cpu number in MADT table (max physical number) which can
exceed the supported maximum cpu number (NR_CPUS, max logical number),
but kernel should not crash. Kernel should boot cpus with NR_CPUS, let
the remainder cpus stay in BIOS.

The potential crash reason is that the array acpi_core_pic[NR_CPUS] can
be overflowed when parsing MADT table, and it is obvious that CORE_PIC
should be corresponding to physical core rather than logical core, so it
is better to define the array as acpi_core_pic[MAX_CORE_PIC].

With the patch, system can boot up 64 vcpus with qemu parameter -smp 128,
otherwise system will crash with the following message.

[    0.000000] CPU 0 Unable to handle kernel paging request at virtual address [PII_REDACTED], era ==[PII_REDACTED]7a5f0c, ra ==[PII_REDACTED]7a46ec
[    0.000000] Oops[#1]:
[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.8.0-rc2+ #192
[    0.000000] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022
[    0.000000] pc[PII_REDACTED]7a5f0c ra[PII_REDACTED]7a46ec tp[PII_REDACTED]c90000 sp[PII_REDACTED]c93d60
[    0.000000] a0 [PII_REDACTED] a[PII_REDACTED]d93bc0 a2 [PII_REDACTED] a3[PII_REDACTED]c93bd8
[    0.000000] a4[PII_REDACTED]c93a74 a5[PII_REDACTED]c93a67 a6[PII_REDACTED]c938f0 a7 [PII_REDACTED]
[    0.000000] t0 [PII_REDACTED] t1 [PII_REDACTED] t2 [PII_REDACTED] t3 [PII_REDACTED]
[    0.000000] t4 [PII_REDACTED] t5 [PII_REDACTED] t6 [PII_REDACTED] t7 [PII_REDACTED]
[    0.000000] t8 [PII_REDACTED] u0 ffffffffffffffff s9 [PII_REDACTED] s0[PII_REDACTED]caee98
[    0.000000] s[PII_REDACTED]1b0480 s2[PII_REDACTED]c93da0 s3[PII_REDACTED]c93d98 s4[PII_REDACTED]c93d90
[    0.000000] s5[PII_REDACTED]caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330
[    0.000000]    ra:[PII_REDACTED]7a46ec platform_init+0x214/0x250
[    0.000000]   ERA:[PII_REDACTED]7a5f0c efi_runtime_init+0x30/0x94
[    0.000000]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
[    0.000000]  PRMD: 00000000 (PPLV0 -PIE -PWE)
[    0.000000]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
[    0.000000]  ECFG: 00070800 (LIE=11 VS=7)
[    0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
[    0.000000]  BADV: [PII_REDACTED]
[    0.000000]  PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)
[    0.000000] Modules linked in:
[    0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))
[    0.000000] Stack :[PII_REDACTED]c93a14 [PII_REDACTED][PII_REDACTED]1844f8[PII_REDACTED]7a46ec
[    0.000000]         000000000a7fd000 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
[    0.000000]         [PII_REDACTED] [PII_REDACTED][PII_REDACTED]9d8[PII_REDACTED]00f556b60
[    0.000000]         000000000a7fd[PII_REDACTED]00f556b08[PII_REDACTED]ca7700 [PII_REDACTED]
[    0.000000]        [PII_REDACTED]c93e50 [PII_REDACTED] [PII_REDACTED][PII_REDACTED]7a484c
[    0.000000]         000000000e0a4[PII_REDACTED]00f556b60 000000000a7fd[PII_REDACTED]00f556b08
[    0.000000]        [PII_REDACTED]ca7700 [PII_REDACTED] [PII_REDACTED] 000000000e02b018
[    0.000000]         000000000a7fd[PII_REDACTED]0037a0790 [PII_REDACTED] [PII_REDACTED]
[    0.000000]         [PII_REDACTED] 000000000e0a4[PII_REDACTED]00f556b60 000000000a7fd000
[    0.000000]         000000000f556b08 000000000eaae[PII_REDACTED]00eaa5040 [PII_REDACTED]
[    0.000000]         ...
[    0.000000] Call Trace:
[    0.000000] [<[PII_REDACTED]7a5f0c>] efi_runtime_init+0x30/0x94
[    0.000000] [<[PII_REDACTED]7a46ec>] platform_init+0x214/0x250
[    0.000000] [<[PII_REDACTED]7a484c>] setup_arch+0x124/0x45c
[    0.000000] [<[PII_REDACTED]7a0790>] start_kernel+0x90/0x670
[    0.000000] [<[PII_REDACTED]78b0d8>] kernel_entry+0xd8/0xdc
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd; https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe; https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280