CVE-2024-35991 (GCVE-0-2024-35991)
Vulnerability from cvelistv5
Published
2024-05-20 09:47
Modified
2025-05-04 09:10
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue drain_workqueue() cannot be called safely in a spinlocked context due to possible task rescheduling. In the multi-task scenario, calling queue_work() while drain_workqueue() will lead to a Call Trace as pushing a work on a draining workqueue is not permitted in spinlocked context. Call Trace: <TASK> ? __warn+0x7d/0x140 ? __queue_work+0x2b2/0x440 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? __queue_work+0x2b2/0x440 queue_work_on+0x28/0x30 idxd_misc_thread+0x303/0x5a0 [idxd] ? __schedule+0x369/0xb40 ? __pfx_irq_thread_fn+0x10/0x10 ? irq_thread+0xbc/0x1b0 irq_thread_fn+0x21/0x70 irq_thread+0x102/0x1b0 ? preempt_count_add+0x74/0xa0 ? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0x103/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> The current implementation uses a spinlock to protect event log workqueue and will lead to the Call Trace due to potential task rescheduling. To address the locking issue, convert the spinlock to mutex, allowing the drain_workqueue() to be called in a safe mutex-locked context. This change ensures proper synchronization when accessing the event log workqueue, preventing potential Call Trace and improving the overall robustness of the code.
References
Impacted products
Vendor Product Version
Linux Linux Version: c40bd7d9737bdcfb02d42765bc6c59b338151123
Version: c40bd7d9737bdcfb02d42765bc6c59b338151123
Version: c40bd7d9737bdcfb02d42765bc6c59b338151123
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:22:23.685967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:50.056Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/758071a35d9f3ffd84ff12169d081412a2f5f098"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d5638de827cff0fce77007e426ec0ffdedf68a44"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/cdev.c",
            "drivers/dma/idxd/debugfs.c",
            "drivers/dma/idxd/device.c",
            "drivers/dma/idxd/idxd.h",
            "drivers/dma/idxd/init.c",
            "drivers/dma/idxd/irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "758071a35d9f3ffd84ff12169d081412a2f5f098",
              "status": "affected",
              "version": "c40bd7d9737bdcfb02d42765bc6c59b338151123",
              "versionType": "git"
            },
            {
              "lessThan": "c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f",
              "status": "affected",
              "version": "c40bd7d9737bdcfb02d42765bc6c59b338151123",
              "versionType": "git"
            },
            {
              "lessThan": "d5638de827cff0fce77007e426ec0ffdedf68a44",
              "status": "affected",
              "version": "c40bd7d9737bdcfb02d42765bc6c59b338151123",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/cdev.c",
            "drivers/dma/idxd/debugfs.c",
            "drivers/dma/idxd/device.c",
            "drivers/dma/idxd/idxd.h",
            "drivers/dma/idxd/init.c",
            "drivers/dma/idxd/irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Convert spinlock to mutex to lock evl workqueue\n\ndrain_workqueue() cannot be called safely in a spinlocked context due to\npossible task rescheduling. In the multi-task scenario, calling\nqueue_work() while drain_workqueue() will lead to a Call Trace as\npushing a work on a draining workqueue is not permitted in spinlocked\ncontext.\n    Call Trace:\n    \u003cTASK\u003e\n    ? __warn+0x7d/0x140\n    ? __queue_work+0x2b2/0x440\n    ? report_bug+0x1f8/0x200\n    ? handle_bug+0x3c/0x70\n    ? exc_invalid_op+0x18/0x70\n    ? asm_exc_invalid_op+0x1a/0x20\n    ? __queue_work+0x2b2/0x440\n    queue_work_on+0x28/0x30\n    idxd_misc_thread+0x303/0x5a0 [idxd]\n    ? __schedule+0x369/0xb40\n    ? __pfx_irq_thread_fn+0x10/0x10\n    ? irq_thread+0xbc/0x1b0\n    irq_thread_fn+0x21/0x70\n    irq_thread+0x102/0x1b0\n    ? preempt_count_add+0x74/0xa0\n    ? __pfx_irq_thread_dtor+0x10/0x10\n    ? __pfx_irq_thread+0x10/0x10\n    kthread+0x103/0x140\n    ? __pfx_kthread+0x10/0x10\n    ret_from_fork+0x31/0x50\n    ? __pfx_kthread+0x10/0x10\n    ret_from_fork_asm+0x1b/0x30\n    \u003c/TASK\u003e\n\nThe current implementation uses a spinlock to protect event log workqueue\nand will lead to the Call Trace due to potential task rescheduling.\n\nTo address the locking issue, convert the spinlock to mutex, allowing\nthe drain_workqueue() to be called in a safe mutex-locked context.\n\nThis change ensures proper synchronization when accessing the event log\nworkqueue, preventing potential Call Trace and improving the overall\nrobustness of the code."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:10:03.849Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/758071a35d9f3ffd84ff12169d081412a2f5f098"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5638de827cff0fce77007e426ec0ffdedf68a44"
        }
      ],
      "title": "dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35991",
    "datePublished": "2024-05-20T09:47:56.401Z",
    "dateReserved": "2024-05-17T13:50:33.146Z",
    "dateUpdated": "2025-05-04T09:10:03.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Convert spinlock to mutex to lock evl workqueue\\n\\ndrain_workqueue() cannot be called safely in a spinlocked context due to\\npossible task rescheduling. In the multi-task scenario, calling\\nqueue_work() while drain_workqueue() will lead to a Call Trace as\\npushing a work on a draining workqueue is not permitted in spinlocked\\ncontext.\\n    Call Trace:\\n    \u003cTASK\u003e\\n    ? __warn+0x7d/0x140\\n    ? __queue_work+0x2b2/0x440\\n    ? report_bug+0x1f8/0x200\\n    ? handle_bug+0x3c/0x70\\n    ? exc_invalid_op+0x18/0x70\\n    ? asm_exc_invalid_op+0x1a/0x20\\n    ? __queue_work+0x2b2/0x440\\n    queue_work_on+0x28/0x30\\n    idxd_misc_thread+0x303/0x5a0 [idxd]\\n    ? __schedule+0x369/0xb40\\n    ? __pfx_irq_thread_fn+0x10/0x10\\n    ? irq_thread+0xbc/0x1b0\\n    irq_thread_fn+0x21/0x70\\n    irq_thread+0x102/0x1b0\\n    ? preempt_count_add+0x74/0xa0\\n    ? __pfx_irq_thread_dtor+0x10/0x10\\n    ? __pfx_irq_thread+0x10/0x10\\n    kthread+0x103/0x140\\n    ? __pfx_kthread+0x10/0x10\\n    ret_from_fork+0x31/0x50\\n    ? __pfx_kthread+0x10/0x10\\n    ret_from_fork_asm+0x1b/0x30\\n    \u003c/TASK\u003e\\n\\nThe current implementation uses a spinlock to protect event log workqueue\\nand will lead to the Call Trace due to potential task rescheduling.\\n\\nTo address the locking issue, convert the spinlock to mutex, allowing\\nthe drain_workqueue() to be called in a safe mutex-locked context.\\n\\nThis change ensures proper synchronization when accessing the event log\\nworkqueue, preventing potential Call Trace and improving the overall\\nrobustness of the code.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: dmaengine: idxd: convertir spinlock a mutex para bloquear evl workqueue. Drain_workqueue() no se puede llamar de forma segura en un contexto de spinlock debido a una posible reprogramaci\\u00f3n de tareas. En el escenario de tareas m\\u00faltiples, llamar a queue_work() mientras Drain_workqueue() generar\\u00e1 un seguimiento de llamadas, ya que no se permite enviar un trabajo a una cola de trabajo agotadora en un contexto de bloqueo por giro. Seguimiento de llamadas:  ? __warn+0x7d/0x140 ? __queue_work+0x2b2/0x440? report_bug+0x1f8/0x200? handle_bug+0x3c/0x70? exc_invalid_op+0x18/0x70? asm_exc_invalid_op+0x1a/0x20? __queue_work+0x2b2/0x440 queue_work_on+0x28/0x30 idxd_misc_thread+0x303/0x5a0 [idxd] ? __schedule+0x369/0xb40? __pfx_irq_thread_fn+0x10/0x10 ? irq_thread+0xbc/0x1b0 irq_thread_fn+0x21/0x70 irq_thread+0x102/0x1b0 ? preempt_count_add+0x74/0xa0? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0x103/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30  La implementaci\\u00f3n actual utiliza un bloqueo giratorio para proteger la cola de trabajo del registro de eventos y conducir\\u00e1 al seguimiento de llamadas debido a una posible reprogramaci\\u00f3n de tareas. Para solucionar el problema de bloqueo, convierta el spinlock a mutex, lo que permite llamar a Drain_workqueue() en un contexto seguro con bloqueo mutex. Este cambio garantiza una sincronizaci\\u00f3n adecuada al acceder a la cola de trabajo del registro de eventos, lo que evita un posible seguimiento de llamadas y mejora la solidez general del c\\u00f3digo.\"}]",
      "id": "CVE-2024-35991",
      "lastModified": "2024-11-21T09:21:22.833",
      "published": "2024-05-20T10:15:13.333",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/758071a35d9f3ffd84ff12169d081412a2f5f098\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d5638de827cff0fce77007e426ec0ffdedf68a44\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/758071a35d9f3ffd84ff12169d081412a2f5f098\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d5638de827cff0fce77007e426ec0ffdedf68a44\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35991\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:13.333\",\"lastModified\":\"2024-11-21T09:21:22.833\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Convert spinlock to mutex to lock evl workqueue\\n\\ndrain_workqueue() cannot be called safely in a spinlocked context due to\\npossible task rescheduling. In the multi-task scenario, calling\\nqueue_work() while drain_workqueue() will lead to a Call Trace as\\npushing a work on a draining workqueue is not permitted in spinlocked\\ncontext.\\n    Call Trace:\\n    \u003cTASK\u003e\\n    ? __warn+0x7d/0x140\\n    ? __queue_work+0x2b2/0x440\\n    ? report_bug+0x1f8/0x200\\n    ? handle_bug+0x3c/0x70\\n    ? exc_invalid_op+0x18/0x70\\n    ? asm_exc_invalid_op+0x1a/0x20\\n    ? __queue_work+0x2b2/0x440\\n    queue_work_on+0x28/0x30\\n    idxd_misc_thread+0x303/0x5a0 [idxd]\\n    ? __schedule+0x369/0xb40\\n    ? __pfx_irq_thread_fn+0x10/0x10\\n    ? irq_thread+0xbc/0x1b0\\n    irq_thread_fn+0x21/0x70\\n    irq_thread+0x102/0x1b0\\n    ? preempt_count_add+0x74/0xa0\\n    ? __pfx_irq_thread_dtor+0x10/0x10\\n    ? __pfx_irq_thread+0x10/0x10\\n    kthread+0x103/0x140\\n    ? __pfx_kthread+0x10/0x10\\n    ret_from_fork+0x31/0x50\\n    ? __pfx_kthread+0x10/0x10\\n    ret_from_fork_asm+0x1b/0x30\\n    \u003c/TASK\u003e\\n\\nThe current implementation uses a spinlock to protect event log workqueue\\nand will lead to the Call Trace due to potential task rescheduling.\\n\\nTo address the locking issue, convert the spinlock to mutex, allowing\\nthe drain_workqueue() to be called in a safe mutex-locked context.\\n\\nThis change ensures proper synchronization when accessing the event log\\nworkqueue, preventing potential Call Trace and improving the overall\\nrobustness of the code.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: dmaengine: idxd: convertir spinlock a mutex para bloquear evl workqueue. Drain_workqueue() no se puede llamar de forma segura en un contexto de spinlock debido a una posible reprogramaci\u00f3n de tareas. En el escenario de tareas m\u00faltiples, llamar a queue_work() mientras Drain_workqueue() generar\u00e1 un seguimiento de llamadas, ya que no se permite enviar un trabajo a una cola de trabajo agotadora en un contexto de bloqueo por giro. Seguimiento de llamadas:  ? __warn+0x7d/0x140 ? __queue_work+0x2b2/0x440? report_bug+0x1f8/0x200? handle_bug+0x3c/0x70? exc_invalid_op+0x18/0x70? asm_exc_invalid_op+0x1a/0x20? __queue_work+0x2b2/0x440 queue_work_on+0x28/0x30 idxd_misc_thread+0x303/0x5a0 [idxd] ? __schedule+0x369/0xb40? __pfx_irq_thread_fn+0x10/0x10 ? irq_thread+0xbc/0x1b0 irq_thread_fn+0x21/0x70 irq_thread+0x102/0x1b0 ? preempt_count_add+0x74/0xa0? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0x103/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30  La implementaci\u00f3n actual utiliza un bloqueo giratorio para proteger la cola de trabajo del registro de eventos y conducir\u00e1 al seguimiento de llamadas debido a una posible reprogramaci\u00f3n de tareas. Para solucionar el problema de bloqueo, convierta el spinlock a mutex, lo que permite llamar a Drain_workqueue() en un contexto seguro con bloqueo mutex. Este cambio garantiza una sincronizaci\u00f3n adecuada al acceder a la cola de trabajo del registro de eventos, lo que evita un posible seguimiento de llamadas y mejora la solidez general del c\u00f3digo.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/758071a35d9f3ffd84ff12169d081412a2f5f098\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5638de827cff0fce77007e426ec0ffdedf68a44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/758071a35d9f3ffd84ff12169d081412a2f5f098\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/d5638de827cff0fce77007e426ec0ffdedf68a44\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/758071a35d9f3ffd84ff12169d081412a2f5f098\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d5638de827cff0fce77007e426ec0ffdedf68a44\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:12.585Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35991\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T17:22:23.685967Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.073Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c40bd7d9737bdcfb02d42765bc6c59b338151123\", \"lessThan\": \"758071a35d9f3ffd84ff12169d081412a2f5f098\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c40bd7d9737bdcfb02d42765bc6c59b338151123\", \"lessThan\": \"c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c40bd7d9737bdcfb02d42765bc6c59b338151123\", \"lessThan\": \"d5638de827cff0fce77007e426ec0ffdedf68a44\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/dma/idxd/cdev.c\", \"drivers/dma/idxd/debugfs.c\", \"drivers/dma/idxd/device.c\", \"drivers/dma/idxd/idxd.h\", \"drivers/dma/idxd/init.c\", \"drivers/dma/idxd/irq.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.30\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/dma/idxd/cdev.c\", \"drivers/dma/idxd/debugfs.c\", \"drivers/dma/idxd/device.c\", \"drivers/dma/idxd/idxd.h\", \"drivers/dma/idxd/init.c\", \"drivers/dma/idxd/irq.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/758071a35d9f3ffd84ff12169d081412a2f5f098\"}, {\"url\": \"https://git.kernel.org/stable/c/c9b732a9f73eadc638abdcf0a6d39bc7a0c1af5f\"}, {\"url\": \"https://git.kernel.org/stable/c/d5638de827cff0fce77007e426ec0ffdedf68a44\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Convert spinlock to mutex to lock evl workqueue\\n\\ndrain_workqueue() cannot be called safely in a spinlocked context due to\\npossible task rescheduling. In the multi-task scenario, calling\\nqueue_work() while drain_workqueue() will lead to a Call Trace as\\npushing a work on a draining workqueue is not permitted in spinlocked\\ncontext.\\n    Call Trace:\\n    \u003cTASK\u003e\\n    ? __warn+0x7d/0x140\\n    ? __queue_work+0x2b2/0x440\\n    ? report_bug+0x1f8/0x200\\n    ? handle_bug+0x3c/0x70\\n    ? exc_invalid_op+0x18/0x70\\n    ? asm_exc_invalid_op+0x1a/0x20\\n    ? __queue_work+0x2b2/0x440\\n    queue_work_on+0x28/0x30\\n    idxd_misc_thread+0x303/0x5a0 [idxd]\\n    ? __schedule+0x369/0xb40\\n    ? __pfx_irq_thread_fn+0x10/0x10\\n    ? irq_thread+0xbc/0x1b0\\n    irq_thread_fn+0x21/0x70\\n    irq_thread+0x102/0x1b0\\n    ? preempt_count_add+0x74/0xa0\\n    ? __pfx_irq_thread_dtor+0x10/0x10\\n    ? __pfx_irq_thread+0x10/0x10\\n    kthread+0x103/0x140\\n    ? __pfx_kthread+0x10/0x10\\n    ret_from_fork+0x31/0x50\\n    ? __pfx_kthread+0x10/0x10\\n    ret_from_fork_asm+0x1b/0x30\\n    \u003c/TASK\u003e\\n\\nThe current implementation uses a spinlock to protect event log workqueue\\nand will lead to the Call Trace due to potential task rescheduling.\\n\\nTo address the locking issue, convert the spinlock to mutex, allowing\\nthe drain_workqueue() to be called in a safe mutex-locked context.\\n\\nThis change ensures proper synchronization when accessing the event log\\nworkqueue, preventing potential Call Trace and improving the overall\\nrobustness of the code.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.30\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.9\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:10:03.849Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35991\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:10:03.849Z\", \"dateReserved\": \"2024-05-17T13:50:33.146Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:47:56.401Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}