CVE-2024-49866: tracing/timerlat: Fix a race during cpuhp processing
In the Linux kernel, the following vulnerability has been resolved:
tracing/timerlat: Fix a race during cpuhp processing
There is another found exception that the "timerlat/1" thread was scheduled on CPU0, and lead to timer corruption finally:
ODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlatirq+0x0/0x220 WARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debugprintobject+0x7d/0xb0 Modules linked in: CPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:debugprintobject+0x7d/0xb0 ... Call Trace: <TASK> ? warn+0x7c/0x110 ? debugprintobject+0x7d/0xb0 ? reportbug+0xf1/0x1d0 ? prbreadvalid+0x17/0x20 ? handlebug+0x3f/0x70 ? excinvalidop+0x13/0x60 ? asmexcinvalidop+0x16/0x20 ? debugprintobject+0x7d/0xb0 ? debugprintobject+0x7d/0xb0 ? pfxtimerlatirq+0x10/0x10 debugobjectinit+0x110/0x150 hrtimerinit+0x1d/0x60 timerlatmain+0xab/0x2d0 ? pfxtimerlatmain+0x10/0x10 kthread+0xb7/0xe0 ? pfxkthread+0x10/0x10 retfromfork+0x2d/0x40 ? pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>
After tracing the scheduling event, it was discovered that the migration of the "timerlat/1" thread was performed during thread creation. Further analysis confirmed that it is because the CPU online processing for osnoise is implemented through workers, which is asynchronous with the offline processing. When the worker was scheduled to create a thread, the CPU may has already been removed from the cpuonlinemask during the offline process, resulting in the inability to select the right CPU:
T1 | T2 [CPUHPONLINE] | cpudevicedown() osnoisehotplugworkfn() | | cpuswritelock() | takedowncpu(1) | cpuswriteunlock() [CPUHPOFFLINE] | cpusreadlock() | startkthread(1) | cpusreadunlock() |
To fix this, skip online processing if the CPU is already offline.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.11.0-rc7+ - Configuration
In tracing/timerlat cpuhp (CPUHP_ONLINE), skip online processing/work scheduling when the target CPU is already offline to avoid the cpuhp race where the CPU is removed from cpu_online_mask during offline processing.
Linux kernel cpuhp processing (tracing/timerlat) skip online processing if CPU is already offline = true
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49866?
CVE-2024-49866 has a high severity rating due to potential race conditions leading to timer corruption in the Linux kernel.
How do I fix CVE-2024-49866?
To fix CVE-2024-49866, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.
Which Linux kernel versions are affected by CVE-2024-49866?
CVE-2024-49866 affects Linux kernel versions from 5.14 to 6.11.3, and specific versions like 6.12-rc1.
Is there a workaround for CVE-2024-49866 if I can't update the kernel?
A reliable workaround for CVE-2024-49866 is not available, hence updating to a patched kernel version is strongly recommended.
How does CVE-2024-49866 impact system performance?
CVE-2024-49866 can lead to timer corruption, which may result in degraded system performance and stability issues.