In the Linux kernel, the following vulnerability has been resolved:
IB/ipoib: Fix mcast list locking
Releasing the `priv->lock` while iterating the `priv->multicast_list` in `ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to remove the items while in the middle of iteration. If the mcast is removed while the lock was dropped, the for loop spins forever resulting in a hard lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):
Task A (kworker/u72:2 below) | Task B (kworker/u72:0 below) -----------------------------------+----------------------------------- ipoib_mcast_join_task(work) | ipoib_ib_dev_flush_light(work) spin_lock_irq(&priv->lock) | __ipoib_ib_dev_flush(priv, ...) list_for_each_entry(mcast, | ipoib_mcast_dev_flush(dev = priv->dev) &priv->multicast_list, list) | ipoib_mcast_join(dev, mcast) | spin_unlock_irq(&priv->lock) | | spin_lock_irqsave(&priv->lock, flags) | list_for_each_entry_safe(mcast, tmcast, | &priv->multicast_list, list) | list_del(&mcast->list); | list_add_tail(&mcast->list, &remove_list) | spin_unlock_irqrestore(&priv->lock, flags) spin_lock_irq(&priv->lock) | | ipoib_mcast_remove_list(&remove_list) (Here, `mcast` is no longer on the | list_for_each_entry_safe(mcast, tmcast, `priv->multicast_list` and we keep | remove_list, list) spinning on the `remove_list` of | >>> wait_for_completion(&mcast->done) the other thread which is blocked | and the list is still valid on | it's stack.)
Fix this by keeping the lock held and changing to GFP_ATOMIC to prevent eventual sleeps. Unfortunately we could not reproduce the lockup and confirm this fix but based on the code review I think this fix should address such lockups.
crash> bc 31 PID: 747 TASK: ff1c6a1a007e8000 CPU: 31 COMMAND: "kworker/u72:2" -- [exception RIP: ipoib_mcast_join_task+0x1b1] RIP: ffffffffc0944ac1 RSP: ff646f199a8c7e00 RFLAGS: 00000002 RAX: 0000000000000000 RBX: ff1c6a1a04dc82f8 RCX: 0000000000000000 work (&priv->mcast_task{,.work}) RDX: ff1c6a192d60ac68 RSI: 0000000000000286 RDI: ff1c6a1a04dc8000 &mcast->list RBP: ff646f199a8c7e90 R8: ff1c699980019420 R9: ff1c6a1920c9a000 R10: ff646f199a8c7e00 R11: ff1c6a191a7d9800 R12: ff1c6a192d60ac00 mcast R13: ff1c6a1d82200000 R14: ff1c6a1a04dc8000 R15: ff1c6a1a04dc82d8 dev priv (&priv->lock) &priv->multicast_list (aka head) ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 --- <NMI exception stack> --- #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib] #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967
crash> rx ff646f199a8c7e68 ff646f199a8c7e68: ff1c6a1a04dc82f8 <<< work = &priv->mcast_task.work
crash> list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000 (empty)
crash> ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000 mcast_task.work.func = 0xffffffffc0944910 <ipoib_mcast_join_task>, mcast_mutex.owner.counter = 0xff1c69998efec000
crash> b 8 PID: 8 TASK: ff1c69998efec000 CPU: 33 COMMAND: "kworker/u72:0" -- #3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646 #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib] #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib] #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib] #7 [ff ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-livepatch-5.10.210-201.852Upgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade python-perfUpgrade perfUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-4.14.343-259.562Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfo | Aug 2, 2024 | Mar 6, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Mar 6, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Jul 16, 2024 | Mar 6, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-tools | Jun 26, 2024 | Mar 6, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelists | Jul 1, 2024 | Mar 6, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-headersUpgrade python3-perfUpgrade perfUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-devel | Jul 23, 2024 | Mar 6, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Jul 17, 2024 | Mar 6, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 6, 2024 |
| Suse | — | Upgrade cluster-md-kmp-rtUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-default-base-rebuildUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade dtb-renesasUpgrade dtb-socionextUpgrade kernel-docsUpgrade dlm-kmp-defaultUpgrade dtb-allwinnerUpgrade dtb-rockchipUpgrade gfs2-kmp-azureUpgrade kernel-rtUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade kernel-source-rtUpgrade dtb-armUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-rtUpgrade kselftests-kmp-azureUpgrade dlm-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-azureUpgrade dtb-sprdUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-defaultUpgrade kernel-source-vanillaUpgrade kernel-azure-develUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-azure-livepatch-develUpgrade dtb-xilinxUpgrade kernel-source-azureUpgrade dtb-broadcomUpgrade dlm-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-sourceUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-default-optionalUpgrade dtb-amlogicUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-default-livepatchUpgrade kernel-rt_debugUpgrade reiserfs-kmp-defaultUpgrade kernel-syms-azureUpgrade dtb-exynosUpgrade kernel-default-manUpgrade kernel-default-develUpgrade dtb-amdUpgrade kernel-docs-htmlUpgrade kernel-rt-develUpgrade cluster-md-kmp-azureUpgrade dtb-apmUpgrade dtb-amazonUpgrade ocfs2-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-obs-qaUpgrade ocfs2-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-macrosUpgrade kernel-develUpgrade kernel-default-extraUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-azure-baseUpgrade gfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade dtb-appleUpgrade kernel-symsUpgrade kernel-kvmsmallUpgrade kernel-devel-rtUpgrade kernel-default-vdsoUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade dtb-lgUpgrade dtb-hisiliconUpgrade dtb-freescaleUpgrade kernel-debugUpgrade dtb-marvellUpgrade kernel-kvmsmall-devel | Apr 18, 2024 | Mar 6, 2024 |
| Ubuntu | — | Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.4.0-1108-raspiUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1123-oracleUpgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-5.4.0-181-genericUpgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-raspi-nolpaeUpgrade linux-image-nvidiaUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1071-ibmUpgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-5.4.0-1084-bluefieldUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.4.0-181-generic-lpaeUpgrade linux-image-awsUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-starfiveUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-genericUpgrade linux-image-gke-5.15Upgrade linux-image-6.1.0-1035-oemUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-bluefieldUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1063-azureUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-ibmUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-oemUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-nvidia-6.5Upgrade linux-image-azureUpgrade linux-image-5.4.0-1129-azureUpgrade linux-image-oem-osp1Upgrade linux-image-oem-22.04bUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1124-awsUpgrade linux-image-gkeop-5.15Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-gkeUpgrade linux-image-kvmUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.5.0-1024-oemUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-oem-20.04cUpgrade linux-image-virtualUpgrade linux-image-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1112-kvmUpgrade linux-image-aws-lts-22.04Upgrade linux-image-intelUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-laptop-23.10Upgrade linux-image-oem-22.04dUpgrade linux-image-oracle-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeopUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-oem-22.04cUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.4.0-1128-gcpUpgrade linux-image-5.15.0-1061-awsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-5.4.0-181-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-raspi2Upgrade linux-image-oem-20.04dUpgrade linux-image-5.4.0-1043-xilinx-zynqmpUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.5.0-41-genericUpgrade linux-image-intel-iotgUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-5.4.0-1036-iotUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-5.4.0-1091-gkeopUpgrade linux-image-generic-64k | Mar 12, 2024 | Mar 6, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 6, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub