CVE: CVE-2023-53067
Published: 2025-05-02
Description: In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Only call get_timer_irq() once in constant_clockevent_init()

Under CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_DEBUG_PREEMPT=y, we can see
the following messages on LoongArch, this is because using might_sleep()
in preemption disable context.

[    0.001127] smp: Bringing up secondary CPUs ...
[    0.001222] Booting CPU#1...
[    0.001244] 64-bit Loongson Processor probed (LA464 Core)
[    0.001247] CPU1 revision is: 0014c012 (Loongson-64bit)
[    0.001250] FPU1 revision is: 00000000
[    0.001252] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283
[    0.001255] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
[    0.001257] preempt_count: 1, expected: 0
[    0.001258] RCU nest depth: 0, expected: 0
[    0.001259] Preemption disabled at:
[    0.001261] [<[PII_REDACTED]>] arch_dup_task_struct+0x20/0x110
[    0.001272] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc7+ #43
[    0.001275] Hardware name: Loongson Loongson-3A5000-7A1000-1w-A2101/Loongson-LS3A5000-7A1000-1w-A2101, BIOS vUDK2018-LoongArch-V4.0.05132-beta10 12/13/202
[    0.001277] Stack : [PII_REDACTED] [PII_REDACTED][PII_REDACTED]222f1c[PII_REDACTED]1e0000
[    0.001286]        [PII_REDACTED]1e3be0[PII_REDACTED]1e3be8 [PII_REDACTED] [PII_REDACTED]
[    0.001292]        [PII_REDACTED]1e3be8 [PII_REDACTED][PII_REDACTED]1e3cb8[PII_REDACTED]1e3a50
[    0.001297]         [PII_REDACTED][PII_REDACTED]1e3be8 be694d10ce4139dd [PII_REDACTED]
[    0.001303]         [PII_REDACTED] [PII_REDACTED] 00000000ffffe0a2 [PII_REDACTED]
[    0.001309]        [PII_REDACTED]00002f [PII_REDACTED][PII_REDACTED]6b0000 ffffffffffffffff
[    0.001314]         [PII_REDACTED] [PII_REDACTED][PII_REDACTED]4f6e90 [PII_REDACTED]
[    0.001320]        [PII_REDACTED]22b69c [PII_REDACTED] [PII_REDACTED][PII_REDACTED]736a90
[    0.001325]         [PII_REDACTED] [PII_REDACTED][PII_REDACTED]222f34 [PII_REDACTED]
[    0.001331]        [PII_REDACTED]0000b0 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
[    0.001337]         ...
[    0.001339] Call Trace:
[    0.001342] [<[PII_REDACTED]222f34>] show_stack+0x5c/0x180
[    0.001346] [<[PII_REDACTED]0bdd80>] dump_stack_lvl+0x60/0x88
[    0.001352] [<[PII_REDACTED]>] __might_resched+0x180/0x1cc
[    0.001356] [<[PII_REDACTED]0c742c>] mutex_lock+0x20/0x64
[    0.001359] [<[PII_REDACTED]2a8ccc>] irq_find_matching_fwspec+0x48/0x124
[    0.001364] [<[PII_REDACTED]2259c4>] constant_clockevent_init+0x68/0x204
[    0.001368] [<[PII_REDACTED]22acf4>] start_secondary+0x40/0xa8
[    0.001371] [<[PII_REDACTED]0c0124>] smpboot_entry+0x60/0x64

Here are the complete call chains:

smpboot_entry()
  start_secondary()
    constant_clockevent_init()
      get_timer_irq()
        irq_find_matching_fwnode()
          irq_find_matching_fwspec()
            mutex_lock()
              might_sleep()
                __might_sleep()
                  __might_resched()

In order to avoid the above issue, we should break the call chains,
using timer_irq_installed variable as check condition to only call
get_timer_irq() once in constant_clockevent_init() is a simple and
proper way.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/acadbd058fa12b510fbecca11eae22bd6f654250; https://git.kernel.org/stable/c/b9c379e1d7e141b102f41858c9b8f6f36e7c89a4; https://git.kernel.org/stable/c/bb7a78e343468873bf00b2b181fcfd3c02d8cb56