CVE-2024-35818

一、漏洞信息
 漏洞编号：[CVE-2024-35818](https://nvd.nist.gov/vuln/detail/CVE-2024-35818)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:LoongArch: Define the __io_aw() hook as mmiowb()Commit fb24ea52f78e0d595852e ( drivers: Remove explicit invocations ofmmiowb() ) remove all mmiowb() in drivers, but it says: NOTE: mmiowb() has only ever guaranteed ordering in conjunction withspin_unlock(). However, pairing each mmiowb() removal in this patch withthe corresponding call to spin_unlock() is not at all trivial, so thereis a small chance that this change may regress any drivers incorrectlyrelying on mmiowb() to order MMIO writes between CPUs using lock-freesynchronisation. The mmio in radeon_ring_commit() is protected by a mutex rather than aspinlock, but in the mutex fastpath it behaves similar to spinlock. Wecan add mmiowb() calls in the radeon driver but the maintainer says hedoesn t like such a workaround, and radeon is not the only example ofmutex protected mmio.So we should extend the mmiowb tracking system from spinlock to mutex,and maybe other locking primitives. This is not easy and error prone, sowe solve it in the architectural code, by simply defining the __io_aw()hook as mmiowb(). And we no longer need to override queued_spin_unlock()so use the generic definition.Without this, we get such an error when run  glxgears  on weak orderingarchitectures such as LoongArch:radeon 0000:04:00.0: ring 0 stalled for more than 10324msecradeon 0000:04:00.0: ring 3 stalled for more than 10240msecradeon 0000:04:00.0: GPU lockup (current fence id 0x000000000001f412 last fence id 0x000000000001f414 on ring 3)radeon 0000:04:00.0: GPU lockup (current fence id 0x000000000000f940 last fence id 0x000000000000f941 on ring 0)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)
 漏洞公开时间：2024-05-17 22:15
 漏洞创建时间：2024-05-17 14:24:46
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-35818
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35818 | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35818.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| suse_bugzilla | https://git.kernel.org/stable/c/97cd43ba824aec764f5ea2790d0c0a318f885167 | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| suse_bugzilla | https://git.kernel.org/stable/c/d7d7c6cdea875be3b241d7d39873bb431db7154d | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| suse_bugzilla | https://git.kernel.org/stable/c/0b61a7dc6712b78799b3949997e8a5e94db5c4b0 | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| suse_bugzilla | https://git.kernel.org/stable/c/9adec248bba33b1503252caf8e59d81febfc5ceb | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| suse_bugzilla | https://git.kernel.org/stable/c/9c68ece8b2a5c5ff9b2fcaea923dd73efeb174cd | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-35818 | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2281200 | https://bugzilla.suse.com/show_bug.cgi?id=1224744 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024051743-CVE-2024-35818-d446@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281200 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-35818 | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://git.kernel.org/linus/9c68ece8b2a5c5ff9b2fcaea923dd73efeb174cd (6.9-rc1) | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://git.kernel.org/stable/c/97cd43ba824aec764f5ea2790d0c0a318f885167 | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://git.kernel.org/stable/c/d7d7c6cdea875be3b241d7d39873bb431db7154d | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://git.kernel.org/stable/c/0b61a7dc6712b78799b3949997e8a5e94db5c4b0 | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://git.kernel.org/stable/c/9adec248bba33b1503252caf8e59d81febfc5ceb | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://git.kernel.org/stable/c/9c68ece8b2a5c5ff9b2fcaea923dd73efeb174cd | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-35818 | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-35818 | https://ubuntu.com/security/CVE-2024-35818 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-35818 | https://ubuntu.com/security/CVE-2024-35818 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-35818 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/9c68ece8b2a5c5ff9b2fcaea923dd73efeb174cd | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:LoongArch: Define the __io_aw() hook as mmiowb()Commit fb24ea52f78e0d595852e ( drivers: Remove explicit invocations ofmmiowb() ) remove all mmiowb() in drivers, but it says: NOTE: mmiowb() has only ever guaranteed ordering in conjunction withspin_unlock(). However, pairing each mmiowb() removal in this patch withthe corresponding call to spin_unlock() is not at all trivial, so thereis a small chance that this change may regress any drivers incorrectlyrelying on mmiowb() to order MMIO writes between CPUs using lock-freesynchronisation. The mmio in radeon_ring_commit() is protected by a mutex rather than aspinlock, but in the mutex fastpath it behaves similar to spinlock. Wecan add mmiowb() calls in the radeon driver but the maintainer says hedoesn t like such a workaround, and radeon is not the only example ofmutex protected mmio.So we should extend the mmiowb tracking system from spinlock to mutex,and maybe other locking primitives. This is not easy and error prone, sowe solve it in the architectural code, by simply defining the __io_aw()hook as mmiowb(). And we no longer need to override queued_spin_unlock()so use the generic definition.Without this, we get such an error when run  glxgears  on weak orderingarchitectures such as LoongArch:radeon 0000:04:00.0: ring 0 stalled for more than 10324msecradeon 0000:04:00.0: ring 3 stalled for more than 10240msecradeon 0000:04:00.0: GPU lockup (current fence id 0x000000000001f412 last fence id 0x000000000001f414 on ring 3)radeon 0000:04:00.0: GPU lockup (current fence id 0x000000000000f940 last fence id 0x000000000000f941 on ring 0)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)radeon 0000:04:00.0: scheduling IB failed (-35).[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn t update BO_VA (-35)
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

src-openEuler/kernel
Closed

Content Risk Flag

Comments (14)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-35818

Comments (14)

Search

src-openEuler/kernel
Closed