CVE-2024-35989

dmaengine: idxd: Fix oops during rmmod on single-CPU platforms

Medium · published May 20, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Fix oops during rmmod on single-CPU platforms

During the removal of the idxd driver, registered offline callback is

invoked as part of the clean up process. However, on systems with only

one CPU online, no valid target is available to migrate the

perf context, resulting in a kernel oops:

BUG: unable to handle page fault for address: 000000000002a2b8

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page

PGD 1470e1067 P4D 0

Oops: 0002 [#1] PREEMPT SMP NOPTI

CPU: 0 PID: 20 Comm: cpuhp/0 Not tainted 6.8.0-rc6-dsa+ #57

Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023

RIP: 0010:mutex_lock+0x2e/0x50

...

Call Trace:

<TASK>

__die+0x24/0x70

page_fault_oops+0x82/0x160

do_user_addr_fault+0x65/0x6b0

__pfx___rdmsr_safe_on_cpu+0x10/0x10

exc_page_fault+0x7d/0x170

asm_exc_page_fault+0x26/0x30

mutex_lock+0x2e/0x50

mutex_lock+0x1e/0x50

perf_pmu_migrate_context+0x87/0x1f0

perf_event_cpu_offline+0x76/0x90 [idxd]

cpuhp_invoke_callback+0xa2/0x4f0

__pfx_perf_event_cpu_offline+0x10/0x10 [idxd]

cpuhp_thread_fun+0x98/0x150

smpboot_thread_fn+0x27/0x260

smpboot_thread_fn+0x1af/0x260

__pfx_smpboot_thread_fn+0x10/0x10

kthread+0x103/0x140

__pfx_kthread+0x10/0x10

ret_from_fork+0x31/0x50

__pfx_kthread+0x10/0x10

ret_from_fork_asm+0x1b/0x30

<TASK>

Fix the issue by preventing the migration of the perf context to an

invalid target.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.1th percentile
Published
2024-05-20T09:47Z
EPSS history
Timeline
  • 20 MAY 09:47Z
    dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
    cvelistv5