CVE-2025-39843

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm: slub: avoid wake up kswapd in set_track_prepare<br /> <br /> set_track_prepare() can incur lock recursion.<br /> The issue is that it is called from hrtimer_start_range_ns<br /> holding the per_cpu(hrtimer_bases)[n].lock, but when enabled<br /> CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare,<br /> and try to hold the per_cpu(hrtimer_bases)[n].lock.<br /> <br /> Avoid deadlock caused by implicitly waking up kswapd by passing in<br /> allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the<br /> debug_objects_fill_pool() case. Inside stack depot they are processed by<br /> gfp_nested_mask().<br /> Since ___slab_alloc() has preemption disabled, we mask out<br /> __GFP_DIRECT_RECLAIM from the flags there.<br /> <br /> The oops looks something like:<br /> <br /> BUG: spinlock recursion on CPU#3, swapper/3/0<br /> lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3<br /> Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT)<br /> Call trace:<br /> spin_bug+0x0<br /> _raw_spin_lock_irqsave+0x80<br /> hrtimer_try_to_cancel+0x94<br /> task_contending+0x10c<br /> enqueue_dl_entity+0x2a4<br /> dl_server_start+0x74<br /> enqueue_task_fair+0x568<br /> enqueue_task+0xac<br /> do_activate_task+0x14c<br /> ttwu_do_activate+0xcc<br /> try_to_wake_up+0x6c8<br /> default_wake_function+0x20<br /> autoremove_wake_function+0x1c<br /> __wake_up+0xac<br /> wakeup_kswapd+0x19c<br /> wake_all_kswapds+0x78<br /> __alloc_pages_slowpath+0x1ac<br /> __alloc_pages_noprof+0x298<br /> stack_depot_save_flags+0x6b0<br /> stack_depot_save+0x14<br /> set_track_prepare+0x5c<br /> ___slab_alloc+0xccc<br /> __kmalloc_cache_noprof+0x470<br /> __set_page_owner+0x2bc<br /> post_alloc_hook[jt]+0x1b8<br /> prep_new_page+0x28<br /> get_page_from_freelist+0x1edc<br /> __alloc_pages_noprof+0x13c<br /> alloc_slab_page+0x244<br /> allocate_slab+0x7c<br /> ___slab_alloc+0x8e8<br /> kmem_cache_alloc_noprof+0x450<br /> debug_objects_fill_pool+0x22c<br /> debug_object_activate+0x40<br /> enqueue_hrtimer[jt]+0xdc<br /> hrtimer_start_range_ns+0x5f8<br /> ...