CVE-2024-46797

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/qspinlock: Fix deadlock in MCS queue

If an interrupt occurs in queued_spin_lock_slowpath() after we increment

qnodesp->count and before node->lock is initialized, another CPU might

see stale lock values in get_tail_qnode(). If the stale lock value happens

to match the lock on that CPU, then we write to the "next" pointer of

the wrong qnode. This causes a deadlock as the former CPU, once it becomes

the head of the MCS queue, will spin indefinitely until it's "next" pointer

is set by its successor in the queue.

Running stress-ng on a 16 core (16EC/16VP) shared LPAR, results in

occasional lockups similar to the following:

$ stress-ng --all 128 --vm-bytes 80% --aggressive \

--maximize --oomable --verify --syslog \

--metrics --times --timeout 5m

watchdog: CPU 15 Hard LOCKUP

......

NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490

LR [c000000001037c5c]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References