CVE-2024-58090

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sched/core: Prevent rescheduling when interrupts are disabled<br /> <br /> David reported a warning observed while loop testing kexec jump:<br /> <br /> Interrupts enabled after irqrouter_resume+0x0/0x50<br /> WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscore_resume+0x18a/0x220<br /> kernel_kexec+0xf6/0x180<br /> __do_sys_reboot+0x206/0x250<br /> do_syscall_64+0x95/0x180<br /> <br /> The corresponding interrupt flag trace:<br /> <br /> hardirqs last enabled at (15573): [] __up_console_sem+0x7e/0x90<br /> hardirqs last disabled at (15580): [] __up_console_sem+0x63/0x90<br /> <br /> That means __up_console_sem() was invoked with interrupts enabled. Further<br /> instrumentation revealed that in the interrupt disabled section of kexec<br /> jump one of the syscore_suspend() callbacks woke up a task, which set the<br /> NEED_RESCHED flag. A later callback in the resume path invoked<br /> cond_resched() which in turn led to the invocation of the scheduler:<br /> <br /> __cond_resched+0x21/0x60<br /> down_timeout+0x18/0x60<br /> acpi_os_wait_semaphore+0x4c/0x80<br /> acpi_ut_acquire_mutex+0x3d/0x100<br /> acpi_ns_get_node+0x27/0x60<br /> acpi_ns_evaluate+0x1cb/0x2d0<br /> acpi_rs_set_srs_method_data+0x156/0x190<br /> acpi_pci_link_set+0x11c/0x290<br /> irqrouter_resume+0x54/0x60<br /> syscore_resume+0x6a/0x200<br /> kernel_kexec+0x145/0x1c0<br /> __do_sys_reboot+0xeb/0x240<br /> do_syscall_64+0x95/0x180<br /> <br /> This is a long standing problem, which probably got more visible with<br /> the recent printk changes. Something does a task wakeup and the<br /> scheduler sets the NEED_RESCHED flag. cond_resched() sees it set and<br /> invokes schedule() from a completely bogus context. The scheduler<br /> enables interrupts after context switching, which causes the above<br /> warning at the end.<br /> <br /> Quite some of the code paths in syscore_suspend()/resume() can result in<br /> triggering a wakeup with the exactly same consequences. They might not<br /> have done so yet, but as they share a lot of code with normal operations<br /> it&amp;#39;s just a question of time.<br /> <br /> The problem only affects the PREEMPT_NONE and PREEMPT_VOLUNTARY scheduling<br /> models. Full preemption is not affected as cond_resched() is disabled and<br /> the preemption check preemptible() takes the interrupt disabled flag into<br /> account.<br /> <br /> Cure the problem by adding a corresponding check into cond_resched().