{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49540","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-02-26T02:08:31.589Z","datePublished":"2025-02-26T02:13:56.012Z","dateUpdated":"2025-12-23T13:24:33.256Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-12-23T13:24:33.256Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix race in schedule and flush work\n\nWhile booting secondary CPUs, cpus_read_[lock/unlock] is not keeping\nonline cpumask stable. The transient online mask results in below\ncalltrace.\n\n[    0.324121] CPU1: Booted secondary processor 0x0000000001 [0x410fd083]\n[    0.346652] Detected PIPT I-cache on CPU2\n[    0.347212] CPU2: Booted secondary processor 0x0000000002 [0x410fd083]\n[    0.377255] Detected PIPT I-cache on CPU3\n[    0.377823] CPU3: Booted secondary processor 0x0000000003 [0x410fd083]\n[    0.379040] ------------[ cut here ]------------\n[    0.383662] WARNING: CPU: 0 PID: 10 at kernel/workqueue.c:3084 __flush_work+0x12c/0x138\n[    0.384850] Modules linked in:\n[    0.385403] CPU: 0 PID: 10 Comm: rcu_tasks_rude_ Not tainted 5.17.0-rc3-v8+ #13\n[    0.386473] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\n[    0.387289] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    0.388308] pc : __flush_work+0x12c/0x138\n[    0.388970] lr : __flush_work+0x80/0x138\n[    0.389620] sp : ffffffc00aaf3c60\n[    0.390139] x29: ffffffc00aaf3d20 x28: ffffffc009c16af0 x27: ffffff80f761df48\n[    0.391316] x26: 0000000000000004 x25: 0000000000000003 x24: 0000000000000100\n[    0.392493] x23: ffffffffffffffff x22: ffffffc009c16b10 x21: ffffffc009c16b28\n[    0.393668] x20: ffffffc009e53861 x19: ffffff80f77fbf40 x18: 00000000d744fcc9\n[    0.394842] x17: 000000000000000b x16: 00000000000001c2 x15: ffffffc009e57550\n[    0.396016] x14: 0000000000000000 x13: ffffffffffffffff x12: 0000000100000000\n[    0.397190] x11: 0000000000000462 x10: ffffff8040258008 x9 : 0000000100000000\n[    0.398364] x8 : 0000000000000000 x7 : ffffffc0093c8bf4 x6 : 0000000000000000\n[    0.399538] x5 : 0000000000000000 x4 : ffffffc00a976e40 x3 : ffffffc00810444c\n[    0.400711] x2 : 0000000000000004 x1 : 0000000000000000 x0 : 0000000000000000\n[    0.401886] Call trace:\n[    0.402309]  __flush_work+0x12c/0x138\n[    0.402941]  schedule_on_each_cpu+0x228/0x278\n[    0.403693]  rcu_tasks_rude_wait_gp+0x130/0x144\n[    0.404502]  rcu_tasks_kthread+0x220/0x254\n[    0.405264]  kthread+0x174/0x1ac\n[    0.405837]  ret_from_fork+0x10/0x20\n[    0.406456] irq event stamp: 102\n[    0.406966] hardirqs last  enabled at (101): [<ffffffc0093c8468>] _raw_spin_unlock_irq+0x78/0xb4\n[    0.408304] hardirqs last disabled at (102): [<ffffffc0093b8270>] el1_dbg+0x24/0x5c\n[    0.409410] softirqs last  enabled at (54): [<ffffffc0081b80c8>] local_bh_enable+0xc/0x2c\n[    0.410645] softirqs last disabled at (50): [<ffffffc0081b809c>] local_bh_disable+0xc/0x2c\n[    0.411890] ---[ end trace 0000000000000000 ]---\n[    0.413000] smp: Brought up 1 node, 4 CPUs\n[    0.413762] SMP: Total of 4 processors activated.\n[    0.414566] CPU features: detected: 32-bit EL0 Support\n[    0.415414] CPU features: detected: 32-bit EL1 Support\n[    0.416278] CPU features: detected: CRC32 instructions\n[    0.447021] Callback from call_rcu_tasks_rude() invoked.\n[    0.506693] Callback from call_rcu_tasks() invoked.\n\nThis commit therefore fixes this issue by applying a single-CPU\noptimization to the RCU Tasks Rude grace-period process.  The key point\nhere is that the purpose of this RCU flavor is to force a schedule on\neach online CPU since some past event.  But the rcu_tasks_rude_wait_gp()\nfunction runs in the context of the RCU Tasks Rude's grace-period kthread,\nso there must already have been a context switch on the current CPU since\nthe call to either synchronize_rcu_tasks_rude() or call_rcu_tasks_rude().\nSo if there is only a single CPU online, RCU Tasks Rude's grace-period\nkthread does not need to anything at all.\n\nIt turns out that the rcu_tasks_rude_wait_gp() function's call to\nschedule_on_each_cpu() causes problems during early boot.  During that\ntime, there is only one online CPU, namely the boot CPU.  Therefore,\napplying this single-CPU optimization fixes early-boot instances of\nthis problem."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/rcu/tasks.h"],"versions":[{"version":"c84aad765406c4c7573ce449e8a9977ebb8f4cb9","lessThan":"1c6c3f2336642fb3074593911f5176565f47ec41","status":"affected","versionType":"git"},{"version":"c84aad765406c4c7573ce449e8a9977ebb8f4cb9","lessThan":"ba722d061bc4b54802d701fc63fc2fd988934603","status":"affected","versionType":"git"},{"version":"c84aad765406c4c7573ce449e8a9977ebb8f4cb9","lessThan":"230bf5878af6038dfb63d9184272a58475236580","status":"affected","versionType":"git"},{"version":"c84aad765406c4c7573ce449e8a9977ebb8f4cb9","lessThan":"8f49a8758b5cd541bd7aa9a0d0d11c7426141c0e","status":"affected","versionType":"git"},{"version":"c84aad765406c4c7573ce449e8a9977ebb8f4cb9","lessThan":"f75fd4b9221d93177c50dcfde671b2e907f53e86","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/rcu/tasks.h"],"versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","status":"unaffected","versionType":"semver"},{"version":"5.10.121","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.46","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.17.14","lessThanOrEqual":"5.17.*","status":"unaffected","versionType":"semver"},{"version":"5.18.3","lessThanOrEqual":"5.18.*","status":"unaffected","versionType":"semver"},{"version":"5.19","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.10.121"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.15.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.17.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.18.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.19"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1c6c3f2336642fb3074593911f5176565f47ec41"},{"url":"https://git.kernel.org/stable/c/ba722d061bc4b54802d701fc63fc2fd988934603"},{"url":"https://git.kernel.org/stable/c/230bf5878af6038dfb63d9184272a58475236580"},{"url":"https://git.kernel.org/stable/c/8f49a8758b5cd541bd7aa9a0d0d11c7426141c0e"},{"url":"https://git.kernel.org/stable/c/f75fd4b9221d93177c50dcfde671b2e907f53e86"}],"title":"rcu-tasks: Fix race in schedule and flush work","x_generator":{"engine":"bippy-1.2.0"}}}}