cve-2025-21634
Vulnerability from cvelistv5
Published
2025-01-19 10:17
Modified
2025-01-20 06:29
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: remove kernfs active break A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 It can be explained by: rmdir echo 1 > cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain cpuset_write_resmask wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files // warning occurs kernfs_put_active This warning is caused by 'kernfs_break_active_protection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently. The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex inside get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change involves calling flush_work(), which can create a multiple processes circular locking dependency that involve cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") added 'kernfs_break_active_protection' in the cpuset_write_resmask. This could lead to this warning. After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset_write_resmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/11cb1d643a74665a4e14749414f48f82cbc15c64Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86edPatch
Impacted products
Vendor Product Version
Linux Linux Version: 76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465
Version: 76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465
 Create a notification for this product.
   Linux Linux Version: 3.16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/cgroup/cpuset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11cb1d643a74665a4e14749414f48f82cbc15c64",
              "status": "affected",
              "version": "76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465",
              "versionType": "git"
            },
            {
              "lessThan": "3cb97a927fffe443e1e7e8eddbfebfdb062e86ed",
              "status": "affected",
              "version": "76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/cgroup/cpuset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: remove kernfs active break\n\nA warning was found:\n\nWARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828\nCPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G\nRIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0\nRSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202\nRAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000\nRDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04\nRBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180\nR10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08\nR13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0\nFS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n kernfs_drain+0x15e/0x2f0\n __kernfs_remove+0x165/0x300\n kernfs_remove_by_name_ns+0x7b/0xc0\n cgroup_rm_file+0x154/0x1c0\n cgroup_addrm_files+0x1c2/0x1f0\n css_clear_dir+0x77/0x110\n kill_css+0x4c/0x1b0\n cgroup_destroy_locked+0x194/0x380\n cgroup_rmdir+0x2a/0x140\n\nIt can be explained by:\nrmdir \t\t\t\techo 1 \u003e cpuset.cpus\n\t\t\t\tkernfs_fop_write_iter // active=0\ncgroup_rm_file\nkernfs_remove_by_name_ns\tkernfs_get_active // active=1\n__kernfs_remove\t\t\t\t\t  // active=0x80000002\nkernfs_drain\t\t\tcpuset_write_resmask\nwait_event\n//waiting (active == 0x80000001)\n\t\t\t\tkernfs_break_active_protection\n\t\t\t\t// active = 0x80000001\n// continue\n\t\t\t\tkernfs_unbreak_active_protection\n\t\t\t\t// active = 0x80000002\n...\nkernfs_should_drain_open_files\n// warning occurs\n\t\t\t\tkernfs_put_active\n\nThis warning is caused by \u0027kernfs_break_active_protection\u0027 when it is\nwriting to cpuset.cpus, and the cgroup is removed concurrently.\n\nThe commit 3a5a6d0c2b03 (\"cpuset: don\u0027t nest cgroup_mutex inside\nget_online_cpus()\") made cpuset_hotplug_workfn asynchronous, This change\ninvolves calling flush_work(), which can create a multiple processes\ncircular locking dependency that involve cgroup_mutex, potentially leading\nto a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 (\"cpuset: break\nkernfs active protection in cpuset_write_resmask()\") added\n\u0027kernfs_break_active_protection\u0027 in the cpuset_write_resmask. This could\nlead to this warning.\n\nAfter the commit 2125c0034c5d (\"cgroup/cpuset: Make cpuset hotplug\nprocessing synchronous\"), the cpuset_write_resmask no longer needs to\nwait the hotplug to finish, which means that concurrent hotplug and cpuset\noperations are no longer possible. Therefore, the deadlock doesn\u0027t exist\nanymore and it does not have to \u0027break active protection\u0027 now. To fix this\nwarning, just remove kernfs_break_active_protection operation in the\n\u0027cpuset_write_resmask\u0027."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-20T06:29:50.665Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11cb1d643a74665a4e14749414f48f82cbc15c64"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed"
        }
      ],
      "title": "cgroup/cpuset: remove kernfs active break",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21634",
    "datePublished": "2025-01-19T10:17:52.983Z",
    "dateReserved": "2024-12-29T08:45:45.726Z",
    "dateUpdated": "2025-01-20T06:29:50.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21634\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:08.890\",\"lastModified\":\"2025-02-03T14:42:29.407\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncgroup/cpuset: remove kernfs active break\\n\\nA warning was found:\\n\\nWARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828\\nCPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G\\nRIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0\\nRSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202\\nRAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000\\nRDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04\\nRBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180\\nR10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08\\nR13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0\\nFS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n kernfs_drain+0x15e/0x2f0\\n __kernfs_remove+0x165/0x300\\n kernfs_remove_by_name_ns+0x7b/0xc0\\n cgroup_rm_file+0x154/0x1c0\\n cgroup_addrm_files+0x1c2/0x1f0\\n css_clear_dir+0x77/0x110\\n kill_css+0x4c/0x1b0\\n cgroup_destroy_locked+0x194/0x380\\n cgroup_rmdir+0x2a/0x140\\n\\nIt can be explained by:\\nrmdir \\t\\t\\t\\techo 1 \u003e cpuset.cpus\\n\\t\\t\\t\\tkernfs_fop_write_iter // active=0\\ncgroup_rm_file\\nkernfs_remove_by_name_ns\\tkernfs_get_active // active=1\\n__kernfs_remove\\t\\t\\t\\t\\t  // active=0x80000002\\nkernfs_drain\\t\\t\\tcpuset_write_resmask\\nwait_event\\n//waiting (active == 0x80000001)\\n\\t\\t\\t\\tkernfs_break_active_protection\\n\\t\\t\\t\\t// active = 0x80000001\\n// continue\\n\\t\\t\\t\\tkernfs_unbreak_active_protection\\n\\t\\t\\t\\t// active = 0x80000002\\n...\\nkernfs_should_drain_open_files\\n// warning occurs\\n\\t\\t\\t\\tkernfs_put_active\\n\\nThis warning is caused by \u0027kernfs_break_active_protection\u0027 when it is\\nwriting to cpuset.cpus, and the cgroup is removed concurrently.\\n\\nThe commit 3a5a6d0c2b03 (\\\"cpuset: don\u0027t nest cgroup_mutex inside\\nget_online_cpus()\\\") made cpuset_hotplug_workfn asynchronous, This change\\ninvolves calling flush_work(), which can create a multiple processes\\ncircular locking dependency that involve cgroup_mutex, potentially leading\\nto a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 (\\\"cpuset: break\\nkernfs active protection in cpuset_write_resmask()\\\") added\\n\u0027kernfs_break_active_protection\u0027 in the cpuset_write_resmask. This could\\nlead to this warning.\\n\\nAfter the commit 2125c0034c5d (\\\"cgroup/cpuset: Make cpuset hotplug\\nprocessing synchronous\\\"), the cpuset_write_resmask no longer needs to\\nwait the hotplug to finish, which means that concurrent hotplug and cpuset\\noperations are no longer possible. Therefore, the deadlock doesn\u0027t exist\\nanymore and it does not have to \u0027break active protection\u0027 now. To fix this\\nwarning, just remove kernfs_break_active_protection operation in the\\n\u0027cpuset_write_resmask\u0027.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cgroup/cpuset: eliminar kernfs active break Se encontr\u00f3 una advertencia: ADVERTENCIA: CPU: 10 PID: 3486953 en fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: cargado Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 00000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:00000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 Se puede explicar por: rmdir echo 1 \u0026gt; cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active // ??activo=1 __kernfs_remove // ??activo=0x80000002 kernfs_drain cpuset_write_resmask wait_event //esperando (activo == 0x80000001) kernfs_break_active_protection // activo = 0x80000001 // continuar kernfs_unbreak_active_protection // activo = 0x80000002 ... kernfs_should_drain_open_files // se produce una advertencia kernfs_put_active Esta advertencia es causada por \u0027kernfs_break_active_protection\u0027 cuando est\u00e1 escribiendo en cpuset.cpus y el cgroup se elimina simult\u00e1neamente. El commit 3a5a6d0c2b03 (\\\"cpuset: no anide cgroup_mutex dentro de get_online_cpus()\\\") hizo que cpuset_hotplug_workfn sea as\u00edncrono. Este cambio implica llamar a flush_work(), que puede crear una dependencia de bloqueo circular de m\u00faltiples procesos que involucran a cgroup_mutex, lo que puede llevar a un bloqueo. Para evitarlo, el commit 76bb5ab8f6e3 (\\\"cpuset: interrumpa la protecci\u00f3n activa de kernfs en cpuset_write_resmask()\\\") agreg\u00f3 \u0027kernfs_break_active_protection\u0027 en cpuset_write_resmask. Esto podr\u00eda llevar a esta advertencia. Despu\u00e9s de el commit 2125c0034c5d (\\\"cgroup/cpuset: haga que el procesamiento de hotplug de cpuset sea sincr\u00f3nico\\\"), cpuset_write_resmask ya no necesita esperar a que finalice el hotplug, lo que significa que las operaciones de hotplug y cpuset concurrentes ya no son posibles. Por lo tanto, el bloqueo ya no existe y ya no es necesario \\\"interrumpir la protecci\u00f3n activa\\\". Para solucionar esta advertencia, simplemente elimine la operaci\u00f3n kernfs_break_active_protection en \\\"cpuset_write_resmask\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"8F9CB506-FF99-4655-9CE3-3F7E0FEC94A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11cb1d643a74665a4e14749414f48f82cbc15c64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.