CVE-2023-53558 Linux内核rcu-tasks自旋锁上下文睡眠漏洞

// CVE-2023-53558 PoC - Triggering the lock context bug // This vulnerability is automatically triggered during kernel boot // when the serial console is enabled. // Reproduction steps: // 1. Build a Linux kernel with CONFIG_DEBUG_LOCK_ALLOC=y // 2. Enable serial console (e.g., console=ttyS0) // 3. Boot the system - the BUG will appear during rcu_init_tasks_generic() // Kernel boot log showing the vulnerability: /* [ 0.206455] cblist_init_generic: Setting adjustable number of callback queues. [ 0.206463] [ 0.206464] ============================= [ 0.206464] [ BUG: Invalid wait context ] [ 0.206465] 5.19.0-00428-g9de1f9c8ca51 #5 Not tainted [ 0.206466] ----------------------------- [ 0.206466] swapper/0/1 is trying to lock: [ 0.206467] ffffffffa0167a58 (&port_lock_key){....}-{3:3}, at: serial8250_console_write+0x327/0x4a0 [ 0.206473] other info that might help us debug this: [ 0.206473] context-{5:5} [ 0.206474] 3 locks held by swapper/0/1: [ 0.206474] #0: ffffffff9eb597e0 (rcu_tasks.cbs_gbl_lock){....}-{2:2}, at: cblist_init_generic.constprop.0+0x14/0x1f0 [ 0.206478] #1: ffffffff9eb579c0 (console_lock){+.+.}-{0:0}, at: _printk+0x63/0x7e [ 0.206482] #2: ffffffff9ea77780 (console_owner){....}-{0:0}, at: console_emit_next_record.constprop.0+0x111/0x330 */ // The fix involves moving pr_info() outside the spin lock critical section: // Before (vulnerable): // spin_lock(&rtp->cbs_gbl_lock); // pr_info("Setting adjustable number of callback queues.\n"); // // ... other operations ... // spin_unlock(&rtp->cbs_gbl_lock); // // After (fixed): // spin_lock(&rtp->cbs_gbl_lock); // // ... other operations ... // spin_unlock(&rtp->cbs_gbl_lock); // pr_info("Setting adjustable number of callback queues.\n");