Bug 2309789 (CVE-2024-44958) - CVE-2024-44958 kernel: sched/smt: Fix unbalance sched_smt_present dec/inc [NEEDINFO]
Summary: CVE-2024-44958 kernel: sched/smt: Fix unbalance sched_smt_present dec/inc
Keywords:
Status: NEW
Alias: CVE-2024-44958
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2309835
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-09-04 19:20 UTC by OSIDB Bzimport
Modified: 2025-05-13 08:27 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:
pauld: needinfo? (rgatica)


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:6966 0 None None None 2025-05-13 08:27:58 UTC

Description OSIDB Bzimport 2024-09-04 19:20:54 UTC
In the Linux kernel, the following vulnerability has been resolved:

sched/smt: Fix unbalance sched_smt_present dec/inc

I got the following warn report while doing stress test:

jump label: negative count!
WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_dec+0x9d/0xb0
Call Trace:
 <TASK>
 __static_key_slow_dec_cpuslocked+0x16/0x70
 sched_cpu_deactivate+0x26e/0x2a0
 cpuhp_invoke_callback+0x3ad/0x10d0
 cpuhp_thread_fun+0x3f5/0x680
 smpboot_thread_fn+0x56d/0x8d0
 kthread+0x309/0x400
 ret_from_fork+0x41/0x70
 ret_from_fork_asm+0x1b/0x30
 </TASK>

Because when cpuset_cpu_inactive() fails in sched_cpu_deactivate(),
the cpu offline failed, but sched_smt_present is decremented before
calling sched_cpu_deactivate(), it leads to unbalanced dec/inc, so
fix it by incrementing sched_smt_present in the error path.

Comment 4 errata-xmlrpc 2025-05-13 08:27:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966


Note You need to log in before you can comment on or make changes to this bug.