CVE: CVE-2024-53089
Published: 2024-11-21
Description: In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Mark hrtimer to expire in hard interrupt context

Like commit 2c0d278f3293f ("KVM: LAPIC: Mark hrtimer to expire in hard
interrupt context") and commit 9090825fa9974 ("KVM: arm/arm64: Let the
timer expire in hardirq context on RT"), On PREEMPT_RT enabled kernels
unmarked hrtimers are moved into soft interrupt expiry mode by default.
Then the timers are canceled from an preempt-notifier which is invoked
with disabled preemption which is not allowed on PREEMPT_RT.

The timer callback is short so in could be invoked in hard-IRQ context.
So let the timer expire on hard-IRQ context even on -RT.

This fix a "scheduling while atomic" bug for PREEMPT_RT enabled kernels:

 BUG: scheduling while atomic: qemu-system-loo/1011/0x00000002
 Modules linked in: amdgpu rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ns
 CPU: 1 UID: 0 PID: 1011 Comm: qemu-system-loo Tainted: G        W          6.12.0-rc2+ #1774
 Tainted: [W]=WARN
 Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022
 Stack : ffffffffffffffff [PII_REDACTED][PII_REDACTED]e3ea38 [PII_REDACTED]
        [PII_REDACTED]7475a0 [PII_REDACTED][PII_REDACTED]7475a8 [PII_REDACTED]
        [PII_REDACTED]8dc[PII_REDACTED]0058dbff8 [PII_REDACTED] [PII_REDACTED]
         [PII_REDACTED] 6a613fc938[PII_REDACTED]00000790c[PII_REDACTED]1001c1140
        [PII_REDACTED]0003fe [PII_REDACTED][PII_REDACTED]00000d [PII_REDACTED]
         [PII_REDACTED][PII_REDACTED]0003f3[PII_REDACTED]90c000 [PII_REDACTED]
        [PII_REDACTED]7ef000 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
         [PII_REDACTED][PII_REDACTED]7f4b58 [PII_REDACTED] [PII_REDACTED]
        [PII_REDACTED]51b600 [PII_REDACTED][PII_REDACTED]a13998 [PII_REDACTED]
        [PII_REDACTED]0000b0 [PII_REDACTED] [PII_REDACTED][PII_REDACTED]071c1d
         ...
 Call Trace:
 [<[PII_REDACTED]a13998>] show_stack+0x38/0x180
 [<[PII_REDACTED]e3ea34>] dump_stack_lvl+0x84/0xc0
 [<[PII_REDACTED]a71708>] __schedule_bug+0x48/0x60
 [<[PII_REDACTED]e45734>] __schedule+0x1114/0x1660
 [<[PII_REDACTED]e46040>] schedule_rtlock+0x20/0x60
 [<[PII_REDACTED]e4e330>] rtlock_slowlock_locked+0x3f0/0x10a0
 [<[PII_REDACTED]e4f038>] rt_spin_lock+0x58/0x80
 [<[PII_REDACTED]b02d68>] hrtimer_cancel_wait_running+0x68/0xc0
 [<[PII_REDACTED]b02e30>] hrtimer_cancel+0x70/0x80
 [<ffff80000235eb70>] kvm_restore_timer+0x50/0x1a0 [kvm]
 [<ffff[PII_REDACTED]c8>] kvm_arch_vcpu_load+0x68/0x2a0 [kvm]
 [<ffff80000234c2d4>] kvm_sched_in+0x34/0x60 [kvm]
 [<[PII_REDACTED]a749a0>] finish_task_switch.isra.0+0x140/0x2e0
 [<[PII_REDACTED]e44a70>] __schedule+0x450/0x1660
 [<[PII_REDACTED]e45cb0>] schedule+0x30/0x180
 [<ffff800002354c70>] kvm_vcpu_block+0x70/0x120 [kvm]
 [<ffff800002354d80>] kvm_vcpu_halt+0x60/0x3e0 [kvm]
 [<ffff80000235b194>] kvm_handle_gspr+0x3f4/0x4e0 [kvm]
 [<ffff80000235f548>] kvm_handle_exit+0x1c8/0x260 [kvm]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1e4c384a4be9ed1e069e24f388ab2ee9951b77b5; https://git.kernel.org/stable/c/73adbd92f3223dc0c3506822b71c6b259d5d537b