Description
In the Linux kernel, the following vulnerability has been resolved: posix-timers: Prevent RT livelock in itimer_delete() itimer_delete() has a retry loop when the timer is concurrently expired. On non-RT kernels this just spin-waits until the timer callback has completed, except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK enabled. In that case and on RT kernels the existing task could live lock when preempting the task which does the timer delivery. Replace spin_unlock() with an invocation of timer_wait_running() to handle it the same way as the other retry loops in the posix timer code.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ec8f954a40da8cd3d159713b608e901f0cd909a9 to < f1be1ed32daa053484222f7f9beb2b16c624dffdaffectedec8f954a40da8cd3d159713b608e901f0cd909a9 to < 0670c4c567b27bd8f999a943028f4fe60d1a1106affectedec8f954a40da8cd3d159713b608e901f0cd909a9 to < e7aff15ba29ba4b3052786b1636fa5c4aa39e179affectedec8f954a40da8cd3d159713b608e901f0cd909a9 to < f9bd298e3e4d3fd6e19f017789a42d0f332cd555affectedec8f954a40da8cd3d159713b608e901f0cd909a9 to < c1968bb8a28625cc95d2ad3ca872ab98c9c36d59affectedec8f954a40da8cd3d159713b608e901f0cd909a9 to < 9d9e522010eb5685d8b53e8a24320653d9d4cbbfaffected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected5.10.188 to ≤ 5.10.*unaffected5.15.121 to ≤ 5.15.*unaffected6.1.39 to ≤ 6.1.*unaffected6.3.13 to ≤ 6.3.*unaffected6.4.4 to ≤ 6.4.*unaffected6.5 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f1be1ed32daa053484222f7f9beb2b16c624dffd ↗
- https://git.kernel.org/stable/c/0670c4c567b27bd8f999a943028f4fe60d1a1106 ↗
- https://git.kernel.org/stable/c/e7aff15ba29ba4b3052786b1636fa5c4aa39e179 ↗
- https://git.kernel.org/stable/c/f9bd298e3e4d3fd6e19f017789a42d0f332cd555 ↗
- https://git.kernel.org/stable/c/c1968bb8a28625cc95d2ad3ca872ab98c9c36d59 ↗
- https://git.kernel.org/stable/c/9d9e522010eb5685d8b53e8a24320653d9d4cbbf ↗