CVE-2024-26841 in Linux
Resumen
por VulDB • 2026-05-25
Enlightened by the user's query, I will analyze the provided kernel crash dump to identify the root cause of the issue.
### 1. Analysis of the Crash Dump
* **Architecture & Hardware**: * **CPU**: Loongson-3A6000-HV (64-bit, MIPS-like ISA but with LoongArch extensions). * **Kernel Version**: `6.8.0-rc5+` (Release Candidate 5, indicating a development or testing kernel). * **Process**: `cpuhp/6` (CPU hotplug thread for CPU 6).
* **Exception Status (ECFG/ESTAT)**: * `ECFG: 00071c1c (LIE=2-4,10-12 VS=7)`: Indicates a **Breakpoint Exception** (LIE=2 usually corresponds to `break` instruction in LoongArch/MIPS-like architectures). * `ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)`: Confirms a **Breakpoint (BRK)** exception. `ECode=12` is the specific code for a breakpoint trap.
* **Call Trace Analysis**: The stack trace shows the execution path leading to the crash: 1. `ret_from_kernel_thread` -> `kthread` -> `smpboot_thread_fn` -> `cpuhp_thread_fun` -> `cpuhp_invoke_callback` * This confirms the crash happened during a **CPU hotplug operation** (specifically, deactivating a CPU). 2. `sched_cpu_deactivate+0x2fc/0x300` * The kernel is trying to deactivate CPU 6 from the scheduler. 3. `__static_key_slow_dec_cpuslocked+0xec/0x100` * This is the critical function. It is decrementing a **static key** (a jump label optimization used in the kernel for conditional branches). 4. `do_bp+0x264/0x420` * This function handles the **Breakpoint (BP)** exception. It calls `report_bug` and `__warn`. 5. `show_stack` -> `dump_stack_lvl` -> `__warn` * The kernel detected an invalid state or a bug check failure and triggered a warning/panic.
### 2. Root Cause Identification
The crash occurs in `__static_key_slow_dec_cpuslocked` during a CPU deactivation. The key insight is that this function is modifying **static keys** (jump labels) while holding the `cpus_read_lock` (or similar lock, as indicated by `_cpuslocked`).
In Linux kernel development, **static keys** are optimized using `jmp` instructions that are patched at runtime. On some architectures, or in specific kernel configurations, modifying these instructions requires careful synchronization.
The most likely causes are:
1. **Race Condition in Static Key Patching**: The `sched_cpu_deactivate` path is modifying a static key that is also being accessed or modified by another CPU or context without proper synchronization. The `cpuslocked` suffix suggests it's trying to do this while holding a CPU hotplug lock, but there might be a missing lock or a deadlock scenario. 2. **Invalid Static Key State**: The static key being decremented might be in an inconsistent state (e.g., already disabled, or corrupted). 3. **Architecture-Specific Bug in LoongArch**: The LoongArch port of the kernel is relatively new. There might be a bug in how `static_key_slow_dec` interacts with the LoongArch instruction set or the CPU hotplug mechanism. The `break` instruction (BRK) is often used by the kernel for debugging or as a placeholder for jump labels. If the patching logic fails, it might leave a `break` instruction in place, which then gets executed, causing the exception. 4. **Kernel Bug in `6.8.0-rc5`**: Since this is an RC kernel, it's highly probable that this is a known or newly introduced bug in the CPU hotplug or static key subsystem.
### 3. Detailed Breakdown of `__static_key_slow_dec_cpuslocked`
This function is part of the `static_key` infrastructure. It is used to disable a static key (make a conditional branch always take the "false" path) while ensuring that no other CPU is in the middle of modifying the key. The `_cpuslocked` variant implies it expects the caller to hold the `cpus_read_lock`.
The crash happens because the function
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.