CVE-2024-44981

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> workqueue: Fix UBSAN &amp;#39;subtraction overflow&amp;#39; error in shift_and_mask()<br /> <br /> UBSAN reports the following &amp;#39;subtraction overflow&amp;#39; error when booting<br /> in a virtual machine on Android:<br /> <br /> | Internal error: UBSAN: integer subtraction overflow: 00000000f2005515 [#1] PREEMPT SMP<br /> | Modules linked in:<br /> | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-00006-g3cbe9e5abd46-dirty #4<br /> | Hardware name: linux,dummy-virt (DT)<br /> | pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> | pc : cancel_delayed_work+0x34/0x44<br /> | lr : cancel_delayed_work+0x2c/0x44<br /> | sp : ffff80008002ba60<br /> | x29: ffff80008002ba60 x28: 0000000000000000 x27: 0000000000000000<br /> | x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000<br /> | x23: 0000000000000000 x22: 0000000000000000 x21: ffff1f65014cd3c0<br /> | x20: ffffc0e84c9d0da0 x19: ffffc0e84cab3558 x18: ffff800080009058<br /> | x17: 00000000247ee1f8 x16: 00000000247ee1f8 x15: 00000000bdcb279d<br /> | x14: 0000000000000001 x13: 0000000000000075 x12: 00000a0000000000<br /> | x11: ffff1f6501499018 x10: 00984901651fffff x9 : ffff5e7cc35af000<br /> | x8 : 0000000000000001 x7 : 3d4d455453595342 x6 : 000000004e514553<br /> | x5 : ffff1f6501499265 x4 : ffff1f650ff60b10 x3 : 0000000000000620<br /> | x2 : ffff80008002ba78 x1 : 0000000000000000 x0 : 0000000000000000<br /> | Call trace:<br /> | cancel_delayed_work+0x34/0x44<br /> | deferred_probe_extend_timeout+0x20/0x70<br /> | driver_register+0xa8/0x110<br /> | __platform_driver_register+0x28/0x3c<br /> | syscon_init+0x24/0x38<br /> | do_one_initcall+0xe4/0x338<br /> | do_initcall_level+0xac/0x178<br /> | do_initcalls+0x5c/0xa0<br /> | do_basic_setup+0x20/0x30<br /> | kernel_init_freeable+0x8c/0xf8<br /> | kernel_init+0x28/0x1b4<br /> | ret_from_fork+0x10/0x20<br /> | Code: f9000fbf 97fffa2f 39400268 37100048 (d42aa2a0)<br /> | ---[ end trace 0000000000000000 ]---<br /> | Kernel panic - not syncing: UBSAN: integer subtraction overflow: Fatal exception<br /> <br /> This is due to shift_and_mask() using a signed immediate to construct<br /> the mask and being called with a shift of 31 (WORK_OFFQ_POOL_SHIFT) so<br /> that it ends up decrementing from INT_MIN.<br /> <br /> Use an unsigned constant &amp;#39;1U&amp;#39; to generate the mask in shift_and_mask().