CVE-2021-47454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47454
In the Linux kernel, the following vulnerability has been resolved: powerpc/smp: do not decrement idle task preempt count in CPU offline With PREEMPT_COUNT=y, when a CPU is offlined and then onlined again, we get: BUG: scheduling while atomic: swapper/1/0/0x00000000 no locks held by swapper/1/0. CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.0-rc2+ #100 Call Trace: dump_stack_lvl+0xac/0x108 __schedule_bug+0xac/0xe0 __schedule+0xcf8/0x10d0 schedule_idle+0x3c/0x70 do_idle+0x2d8/0x4a0 cpu_startup_entry+0x38/0x40 start_secondary+0x2ec/0x3a0 start_secondary_prolog+0x10/0x14 This is because powerpc's arch_cpu_idle_dead() decrements the idle task's preempt count, for reasons explained in commit a7c2bb8279d2 ("powerpc: Re-enable preemption before cpu_die()"), specifically "start_secondary() expects a preempt_count() of 0." However, since commit 2c669ef6979c ("powerpc/preempt: Don't touch the idle task's preempt_count during hotplug") and commit f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled"), that justification no longer holds. The idle task isn't supposed to re-enable preemption, so remove the vestigial preempt_enable() from the CPU offline path. Tested with pseries and powernv in qemu, and pseries on PowerVM.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3ea0b497a7a2fff6a4b7090310c9f52c91975934 Patch
https://git.kernel.org/stable/c/53770a411559cf7bc0906d1df319cc533d2f4f58 Patch
https://git.kernel.org/stable/c/787252a10d9422f3058df9a4821f389e5326c440 Patch
https://git.kernel.org/stable/c/3ea0b497a7a2fff6a4b7090310c9f52c91975934 Patch
https://git.kernel.org/stable/c/53770a411559cf7bc0906d1df319cc533d2f4f58 Patch
https://git.kernel.org/stable/c/787252a10d9422f3058df9a4821f389e5326c440 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*
History

29 Sep 2025, 16:48

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3ea0b497a7a2fff6a4b7090310c9f52c91975934 - () https://git.kernel.org/stable/c/3ea0b497a7a2fff6a4b7090310c9f52c91975934 - Patch
References () https://git.kernel.org/stable/c/53770a411559cf7bc0906d1df319cc533d2f4f58 - () https://git.kernel.org/stable/c/53770a411559cf7bc0906d1df319cc533d2f4f58 - Patch
References () https://git.kernel.org/stable/c/787252a10d9422f3058df9a4821f389e5326c440 - () https://git.kernel.org/stable/c/787252a10d9422f3058df9a4821f389e5326c440 - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
CWE NVD-CWE-noinfo
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 06:36

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/smp: no disminuye el recuento de prioridad de tareas inactivas en la CPU fuera de línea Con PREEMPT_COUNT=y, cuando una CPU está fuera de línea y luego vuelve a estar en línea, obtenemos: ERROR: programación mientras es atómica: swapper/1/0/0x00000000 no hay bloqueos retenidos por swapper/1/0. CPU: 1 PID: 0 Comunicaciones: swapper/1 No contaminado 5.15.0-rc2+ #100 Seguimiento de llamadas: dump_stack_lvl+0xac/0x108 __schedule_bug+0xac/0xe0 __schedule+0xcf8/0x10d0 Schedule_idle+0x3c/0x70 do_idle+0x2d8/0x4a0 entrada_arriba+ 0x38/0x40 start_secondary+0x2ec/0x3a0 start_secondary_prolog+0x10/0x14 Esto se debe a que arch_cpu_idle_dead() de powerpc disminuye el recuento de apropiación de tareas inactivas, por razones explicadas en el commit a7c2bb8279d2 ("powerpc: volver a habilitar la apropiación antes de cpu_die()"), específicamente " start_secondary() espera un preempt_count() de 0." Sin embargo, desde el commit 2c669ef6979c ("powerpc/preempt: no toque el preempt_count de la tarea inactiva durante la conexión en caliente") y el commit f1a0a376ca0c ("sched/core: inicialice la tarea inactiva con la preferencia deshabilitada"), esa justificación ya no se cumple. No se supone que la tarea inactiva vuelva a habilitar la preferencia, por lo tanto, elimine el preempt_enable() residual de la ruta fuera de línea de la CPU. Probado con pseries y powernv en qemu y pseries en PowerVM.
References () https://git.kernel.org/stable/c/3ea0b497a7a2fff6a4b7090310c9f52c91975934 - () https://git.kernel.org/stable/c/3ea0b497a7a2fff6a4b7090310c9f52c91975934 -
References () https://git.kernel.org/stable/c/53770a411559cf7bc0906d1df319cc533d2f4f58 - () https://git.kernel.org/stable/c/53770a411559cf7bc0906d1df319cc533d2f4f58 -
References () https://git.kernel.org/stable/c/787252a10d9422f3058df9a4821f389e5326c440 - () https://git.kernel.org/stable/c/787252a10d9422f3058df9a4821f389e5326c440 -

22 May 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 07:15

Updated : 2025-09-29 16:48

NVD link : CVE-2021-47454

Mitre link : CVE-2021-47454

CVE.ORG link : CVE-2021-47454

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo