CVE: CVE-2024-56585
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix sleeping in atomic context for PREEMPT_RT

Commit bab1c299f3945ffe79 ("LoongArch: Fix sleeping in atomic context in
setup_tlb_handler()") changes the gfp flag from GFP_KERNEL to GFP_ATOMIC
for alloc_pages_node(). However, for PREEMPT_RT kernels we can still get
a "sleeping in atomic context" error:

[    0.372259] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
[    0.372266] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
[    0.372268] preempt_count: 1, expected: 0
[    0.372270] RCU nest depth: 1, expected: 1
[    0.372272] 3 locks held by swapper/1/0:
[    0.372274]  #0: 900000000c9f5e60 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x524/0x1c60
[    0.372294]  #1:[PII_REDACTED]7013b8 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x50/0x140
[    0.372305]  #2: 900000047fffd388 (&zone->lock){+.+.}-{3:3}, at: __rmqueue_pcplist+0x30c/0xea0
[    0.372314] irq event stamp: 0
[    0.372316] hardirqs last  enabled at (0): [<[PII_REDACTED]>] 0x0
[    0.372322] hardirqs last disabled at (0): [<[PII_REDACTED]>] copy_process+0x9c0/0x26e0
[    0.372329] softirqs last  enabled at (0): [<[PII_REDACTED]>] copy_process+0x9c0/0x26e0
[    0.372335] softirqs last disabled at (0): [<[PII_REDACTED]>] 0x0
[    0.372341] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7+ #1891
[    0.372346] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022
[    0.372349] Stack : [PII_REDACTED][PII_REDACTED]a0db9c[PII_REDACTED]1519c8 [PII_REDACTED]
[    0.372486]        [PII_REDACTED]38b890 [PII_REDACTED][PII_REDACTED]38b[PII_REDACTED]007e53788
[    0.372492]        [PII_REDACTED]15bcc8[PII_REDACTED]15bcc0[PII_REDACTED]38b700 [PII_REDACTED]
[    0.372498]         [PII_REDACTED] 4b031894b9d6b[PII_REDACTED]0055ec[PII_REDACTED]100338fc0
[    0.372503]        [PII_REDACTED]0000c4 [PII_REDACTED][PII_REDACTED]00002d [PII_REDACTED]
[    0.372509]         [PII_REDACTED] [PII_REDACTED][PII_REDACTED]5ec000 [PII_REDACTED]
[    0.372515]        [PII_REDACTED]06d[PII_REDACTED]007e53[PII_REDACTED]0000000b0 [PII_REDACTED]
[    0.372521]         [PII_REDACTED] [PII_REDACTED] 900000000c9f5f10 [PII_REDACTED]
[    0.372526]        [PII_REDACTED]6f12d8[PII_REDACTED]e53788 [PII_REDACTED] [PII_REDACTED]
[    0.372532]        [PII_REDACTED]0000b0 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
[    0.372537]         ...
[    0.372540] Call Trace:
[    0.372542] [<[PII_REDACTED]>] show_stack+0x38/0x180
[    0.372548] [<[PII_REDACTED]1519c4>] dump_stack_lvl+0x94/0xe4
[    0.372555] [<[PII_REDACTED]99b880>] __might_resched+0x1a0/0x260
[    0.372561] [<[PII_REDACTED]1675cc>] rt_spin_lock+0x4c/0x140
[    0.372565] [<[PII_REDACTED]cbb768>] __rmqueue_pcplist+0x308/0xea0
[    0.372570] [<[PII_REDACTED]cbed84>] get_page_from_freelist+0x564/0x1c60
[    0.372575] [<[PII_REDACTED]cc0d98>] __alloc_pages_noprof+0x218/0x1820
[    0.372580] [<[PII_REDACTED]93b36c>] tlb_init+0x1ac/0x298
[    0.372585] [<[PII_REDACTED]924b74>] per_cpu_trap_init+0x114/0x140
[    0.372589] [<[PII_REDACTED]>] cpu_probe+0x4e4/0xa60
[    0.372592] [<[PII_REDACTED]>] start_secondary+0x34/0xc0
[    0.372599] [<[PII_REDACTED]15615c>] smpboot_entry+0x64/0x6c

This is because in PREEMPT_RT kernels normal spinlocks are replaced by
rt spinlocks and rt_spin_lock() will cause sleeping. Fix it by disabling
NUMA optimization completely for PREEMPT_RT kernels.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/08715b741f9b2a925d6485491e4907f3b29bac70; https://git.kernel.org/stable/c/6575e0867bd478a5d7ef1783ca1e73160807d238; https://git.kernel.org/stable/c/88fd2b70120d52c1010257d[PII_REDACTED]1375490