CVE-2024-35985
Assigner: Linux
Published: 2024-05-20T09:47:52.389Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()

It was possible to have pick_eevdf() return NULL, which then causes a
NULL-deref. This turned out to be due to entity_eligible() returning
falsely negative because of a s64 multiplcation overflow.

Specifically, reweight_eevdf() computes the vlag without considering
the limit placed upon vlag as update_entity_lag() does, and then the
scaling multiplication (remember that weight is 20bit fixed point) can
overflow. This then leads to the new vruntime being weird which then
causes the above entity_eligible() to go side-ways and claim nothing
is eligible.

Thus limit the range of vlag accordingly.

All this was quite rare, but fatal when it does happen.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 14204acc09f6
lessThan: 470d347b14b0
status: affected
versionType: git
version: eab03c23c2a1
lessThan: 06f27e6d7bf0
status: affected
versionType: git
version: eab03c23c2a1
lessThan: 1560d1f6eb6b
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 6.7
status: affected
version: 0
lessThan: 6.7
status: unaffected
versionType: custom
version: 6.6.30
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.8.9
lessThanOrEqual: 6.8.*
status: unaffected
versionType: custom
version: 6.9
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()
x_generator: engine: bippy-d175d3acf727