CVE-2023-53029

octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt

published March 27, 2025

CVSS
—
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt

The commit 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura

free") uses the get/put_cpu() to protect the usage of percpu pointer

in ->aura_freeptr() callback, but it also unnecessarily disable the

preemption for the blockable memory allocation. The commit 87b93b678e95

("octeontx2-pf: Avoid use of GFP_KERNEL in atomic context") tried to

fix these sleep inside atomic warnings. But it only fix the one for

the non-rt kernel. For the rt kernel, we still get the similar warnings

like below.

BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46

in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0

preempt_count: 1, expected: 0

RCU nest depth: 0, expected: 0

3 locks held by swapper/0/1:

#0: ffff800009fc5fe8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x24/0x30

#1: ffff000100c276c0 (&mbox->lock){+.+.}-{3:3}, at: otx2_init_hw_resources+0x8c/0x3a4

#2: ffffffbfef6537e0 (&cpu_rcache->lock){+.+.}-{2:2}, at: alloc_iova_fast+0x1ac/0x2ac

Preemption disabled at:

[<ffff800008b1908c>] otx2_rq_aura_pool_init+0x14c/0x284

CPU: 20 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc3-rt1-yocto-preempt-rt #1

Hardware name: Marvell OcteonTX CN96XX board (DT)

Call trace:

dump_backtrace.part.0+0xe8/0xf4

show_stack+0x20/0x30

dump_stack_lvl+0x9c/0xd8

dump_stack+0x18/0x34

__might_resched+0x188/0x224

rt_spin_lock+0x64/0x110

alloc_iova_fast+0x1ac/0x2ac

iommu_dma_alloc_iova+0xd4/0x110

__iommu_dma_map+0x80/0x144

iommu_dma_map_page+0xe8/0x260

dma_map_page_attrs+0xb4/0xc0

__otx2_alloc_rbuf+0x90/0x150

otx2_rq_aura_pool_init+0x1c8/0x284

otx2_init_hw_resources+0xe4/0x3a4

otx2_open+0xf0/0x610

__dev_open+0x104/0x224

__dev_change_flags+0x1e4/0x274

dev_change_flags+0x2c/0x7c

ic_open_devs+0x124/0x2f8

ip_auto_config+0x180/0x42c

do_one_initcall+0x90/0x4dc

do_basic_setup+0x10c/0x14c

kernel_init_freeable+0x10c/0x13c

kernel_init+0x2c/0x140

ret_from_fork+0x10/0x20

Of course, we can shuffle the get/put_cpu() to only wrap the invocation

of ->aura_freeptr() as what commit 87b93b678e95 does. But there are only

two ->aura_freeptr() callbacks, otx2_aura_freeptr() and

cn10k_aura_freeptr(). There is no usage of perpcu variable in the

otx2_aura_freeptr() at all, so the get/put_cpu() seems redundant to it.

We can move the get/put_cpu() into the corresponding callback which

really has the percpu variable usage and avoid the sprinkling of

get/put_cpu() in several places.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Published
2025-03-27T16:43Z
EPSS history
Timeline
  • 27 MAR 16:43Z
    octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
    cvelistv5