CVE-2023-53029 Information

Description

In the Linux kernel the following vulnerability has been resolved:

octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt

The commit 4af1b64f80fb (\octeontx2-pf: Fix lmtst ID used in aura free) uses the get/put_cpu() to protect the usage of percpu pointer in ->aura_freeptr() callback but it also unnecessarily disable the preemption for the blockable memory allocation. The commit 87b93b678e95 (\octeontx2-pf: Avoid use of GFP_KERNEL in atomic context) tried to fix these sleep inside atomic warnings. But it only fix the one for the non-rt kernel. For the rt kernel we still get the similar warnings like below. BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 1 irqs_disabled(): 0 non_block: 0 pid: 1 name: swapper/0 preempt_count: 1 expected: 0 RCU nest depth: 0 expected: 0 3 locks held by swapper/0/1: 0: ffff800009fc5fe8 (rtnl_mutex)+.+.-3:3 at: rtnl_lock+0x24/0x30 1: ffff000100c276c0 (&mbox->lock)+.+.-3:3 at: otx2_init_hw_resources+0x8c/0x3a4 2: ffffffbfef6537e0 (&cpu_rcache->lock)+.+.-2:2 at: alloc_iova_fast+0x1ac/0x2ac Preemption disabled at: [] otx2_rq_aura_pool_init+0x14c/0x284 CPU: 20 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc3-rt1-yocto-preempt-rt 1 Hardware name: Marvell OcteonTX CN96XX board (DT) Call trace: dump_backtrace.part.0+0xe8/0xf4 show_stack+0x20/0x30 dump_stack_lvl+0x9c/0xd8 dump_stack+0x18/0x34 __might_resched+0x188/0x224 rt_spin_lock+0x64/0x110 alloc_iova_fast+0x1ac/0x2ac iommu_dma_alloc_iova+0xd4/0x110 __iommu_dma_map+0x80/0x144 iommu_dma_map_page+0xe8/0x260 dma_map_page_attrs+0xb4/0xc0 __otx2_alloc_rbuf+0x90/0x150 otx2_rq_aura_pool_init+0x1c8/0x284 otx2_init_hw_resources+0xe4/0x3a4 otx2_open+0xf0/0x610 __dev_open+0x104/0x224 __dev_change_flags+0x1e4/0x274 dev_change_flags+0x2c/0x7c ic_open_devs+0x124/0x2f8 ip_auto_config+0x180/0x42c do_one_initcall+0x90/0x4dc do_basic_setup+0x10c/0x14c kernel_init_freeable+0x10c/0x13c kernel_init+0x2c/0x140 ret_from_fork+0x10/0x20

Of course we can shuffle the get/put_cpu() to only wrap the invocation of ->aura_freeptr() as what commit 87b93b678e95 does. But there are only two ->aura_freeptr() callbacks otx2_aura_freeptr() and cn10k_aura_freeptr(). There is no usage of perpcu variable in the otx2_aura_freeptr() at all so the get/put_cpu() seems redundant to it. We can move the get/put_cpu() into the corresponding callback which really has the percpu variable usage and avoid the sprinkling of get/put_cpu() in several places.

Reference

https://git.kernel.org/stable/c/29e9c67bf3271067735c188e95cf3631ecd64d58 https://git.kernel.org/stable/c/55ba18dc62deff5910c0fa64486dea1ff20832ff https://git.kernel.org/stable/c/659518e013d6bd562bb0f1d2d9f99d0ac54720e2