In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched\/fair: Fix overflow in update_tg_cfs_runnable()<\/p>\n
A divide-by-zero crash is observed when running hackbench:<\/p>\n
[14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+
\n [14697.492627] RIP: 0010:propagate_entity_load_avg+0x35f\/0x3e0
\n [14697.506799]
\n [14697.507411] __dequeue_task+0x2b4\/0xc70
\n [14697.508677] dequeue_task_fair+0x36\/0x370
\n [14697.509047] dequeue_task+0x101\/0x2f0
\n [14697.509426] __schedule+0x1b1\/0x1a00
\n [14697.510868] anon_pipe_read+0x3da\/0x450
\n [14697.511400] vfs_read+0x361\/0x390
\n [14697.512053] __x64_sys_read+0x19\/0x30<\/p>\n
The divide-by-zero happens here:<\/p>\n
if (scale_load_down(gcfs_rq->load.weight)) {
\n load_sum = div_u64(gcfs_rq->avg.load_sum,
\n scale_load_down(gcfs_rq->load.weight));
\n }<\/p>\n
gcfs_rq->load.weight is an insane large value and is truncated
\nto the lower 32 bits by div_u64, which happen to be 0.<\/p>\n
Using AI for investigation, the cause is a u32 overflow in
\nupdate_tg_cfs_runnable(), and flat pickup became a victim when using
\ntg_tasks():<\/p>\n
u32 new_sum, divider;
\n …
\n new_sum = se->avg.runnable_avg * divider; runnable_avg<\/p>\n
update_cfs_group()
\n calc_concur_shares()
\n tg_tasks() # long-to-int truncation, negative nr
\n reweight_entity() # corrupted se->load.weight
\n update_load_add() # corrupted cfs_rq->load.weight<\/p>\n
propagate_entity_load_avg()
\n update_tg_cfs_load()
\n div_u64() # divide-by-zero<\/p>\n
Fix by widening new_sum from u32 to u64 (no need to force tg_tasks()
\nto return unsigned long after this fix)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched\/fair: Fix overflow in update_tg_cfs_runnable()<\/p>\n
A divide-by-zero crash is observed when running hackbench:<\/p>\n
[14697.488452]<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26039","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}