CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock
In the Linux kernel, the following vulnerability has been resolved:
dropmonitor: replace spinlock by rawspinlock
tracedropcommon() is called with preemption disabled, and it acquires a spinlock. This is problematic for RT kernels because spinlocks are sleeping locks in this configuration, which causes the following splat:
BUG: sleeping function called from invalid context at kernel/locking/spinlockrt.c:48 inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 449, name: rcuc/47 preemptcount: 1, expected: 0 RCU nest depth: 2, expected: 2 5 locks held by rcuc/47/449: #0: ff1100086ec30a60 ((softirqctrl.lock)){+.+.}-{2:2}, at: localbhdisableip+0x105/0x210 #1: ffffffffb394a280 (rcureadlock){....}-{1:2}, at: rtspinlock+0xbf/0x130 #2: ffffffffb394a280 (rcureadlock){....}-{1:2}, at: localbhdisableip+0x11c/0x210 #3: ffffffffb394a160 (rcucallback){....}-{0:0}, at: rcudobatch+0x360/0xc70 #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: tracedropcommon.constprop.0+0xb5/0x290 irq event stamp: 139909 hardirqs last enabled at (139908): [<ffffffffb1df2b33>] rawspinunlockirqrestore+0x63/0x80 hardirqs last disabled at (139909): [<ffffffffb19bd03d>] tracedropcommon.constprop.0+0x26d/0x290 softirqs last enabled at (139892): [<ffffffffb07a1083>] localbhenableip+0x103/0x170 softirqs last disabled at (139898): [<ffffffffb0909b33>] rcucpukthread+0x93/0x1f0 Preemption disabled at: [<ffffffffb1de786b>] rtmutexslowunlock+0xab/0x2e0 CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dumpstacklvl+0x8c/0xd0 dumpstack+0x14/0x20 mightresched+0x21e/0x2f0 rtspinlock+0x5e/0x130 ? tracedropcommon.constprop.0+0xb5/0x290 ? skbqueuepurgereason.part.0+0x1bf/0x230 tracedropcommon.constprop.0+0xb5/0x290 ? preemptcountsub+0x1c/0xd0 ? rawspinunlockirqrestore+0x4a/0x80 ? pfxtracedropcommon.constprop.0+0x10/0x10 ? rtmutexslowunlock+0x26a/0x2e0 ? skbqueuepurgereason.part.0+0x1bf/0x230 ? pfxrtmutexslowunlock+0x10/0x10 ? skbqueuepurgereason.part.0+0x1bf/0x230 tracekfreeskbhit+0x15/0x20 tracekfreeskb+0xe9/0x150 kfreeskbreason+0x7b/0x110 skbqueuepurgereason.part.0+0x1bf/0x230 ? pfxskbqueuepurgereason.part.0+0x10/0x10 ? marklock.part.0+0x8a/0x520 ...
tracedropcommon() also disables interrupts, but this is a minor issue because we could easily replace it with a locallock.
Replace the spinlock with rawspinlock to avoid sleeping in atomic context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40980?
CVE-2024-40980 has a medium severity level due to its potential impact on real-time Linux kernels.
What systems are affected by CVE-2024-40980?
CVE-2024-40980 affects various versions of the Linux kernel from 5.4.279 to 6.9.7.
How do I fix CVE-2024-40980?
To remediate CVE-2024-40980, update to the recommended kernel versions such as 5.10.223-1 or 6.1.123-1.
What is the nature of the vulnerability in CVE-2024-40980?
CVE-2024-40980 involves the use of spin_lock in the kernel, which can cause issues in real-time kernels due to blocking behavior.
How can I identify if my Linux kernel is vulnerable to CVE-2024-40980?
You can check your Linux kernel version against the affected versions listed for CVE-2024-40980 to determine if it is vulnerable.