Commit fbd75617 authored by Yongjian Sun's avatar Yongjian Sun
Browse files

riscv: Fix sleeping in invalid context in die() 

mainline inclusion
from mainline-v6.12-rc3
commit 6a97f4118ac07cfdc316433f385dbdc12af5025e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6SH
CVE: CVE-2024-57939

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6a97f4118ac07cfdc316433f385dbdc12af5025e



--------------------------------

die() can be called in exception handler, and therefore cannot sleep.
However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled.
That causes the following warning:

BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex
preempt_count: 110001, expected: 0
RCU nest depth: 0, expected: 0
CPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
dump_backtrace+0x1c/0x24
show_stack+0x2c/0x38
dump_stack_lvl+0x5a/0x72
dump_stack+0x14/0x1c
__might_resched+0x130/0x13a
rt_spin_lock+0x2a/0x5c
die+0x24/0x112
do_trap_insn_illegal+0xa0/0xea
_new_vmalloc_restore_context_a0+0xcc/0xd8
Oops - illegal instruction [#1]

Switch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT
enabled.

Fixes: 76d2a049 ("RISC-V: Init and Halt Code")
Signed-off-by: default avatarNam Cao <namcao@linutronix.de>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20241118091333.1185288-1-namcao@linutronix.de


Signed-off-by: default avatarPalmer Dabbelt <palmer@rivosinc.com>
Conflicts:
		arch/riscv/kernel/traps.c
[Context Changed]
Signed-off-by: default avatarYongjian Sun <sunyongjian1@huawei.com>
parent ab9846a0

arch/riscv/kernel/traps.c

+3 −3
Original line number Diff line number Diff line
@@ -37,7 +37,7 @@ 


int show_unhandled_signals = 1;



static DEFINE_SPINLOCK(die_lock);

static DEFINE_RAW_SPINLOCK(die_lock);



static void dump_kernel_instr(const char *loglvl, struct pt_regs *regs)

{
@@ -69,7 +69,7 @@ void die(struct pt_regs *regs, const char *str) 


	oops_enter();



	spin_lock_irqsave(&die_lock, flags);

	raw_spin_lock_irqsave(&die_lock, flags);

	console_verbose();

	bust_spinlocks(1);
@@ -88,7 +88,7 @@ void die(struct pt_regs *regs, const char *str) 


	bust_spinlocks(0);

	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);

	spin_unlock_irqrestore(&die_lock, flags);

	raw_spin_unlock_irqrestore(&die_lock, flags);

	oops_exit();



	if (in_interrupt())