CVE-2021-47454

powerpc/smp: do not decrement idle task preempt count in CPU offline

MEDIUM
5.5
CVSS Score
Published: May 22, 2024 at 06:19 AM UTC
Updated: June 17, 2026 at 04:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/smp: do not decrement idle task preempt count in CPU offline With PREEMPT_COUNT=y, when a CPU is offlined and then onlined again, we get: BUG: scheduling while atomic: swapper/1/0/0x00000000 no locks held by swapper/1/0. CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.0-rc2+ #100 Call Trace: dump_stack_lvl+0xac/0x108 __schedule_bug+0xac/0xe0 __schedule+0xcf8/0x10d0 schedule_idle+0x3c/0x70 do_idle+0x2d8/0x4a0 cpu_startup_entry+0x38/0x40 start_secondary+0x2ec/0x3a0 start_secondary_prolog+0x10/0x14 This is because powerpc's arch_cpu_idle_dead() decrements the idle task's preempt count, for reasons explained in commit a7c2bb8279d2 ("powerpc: Re-enable preemption before cpu_die()"), specifically "start_secondary() expects a preempt_count() of 0." However, since commit 2c669ef6979c ("powerpc/preempt: Don't touch the idle task's preempt_count during hotplug") and commit f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled"), that justification no longer holds. The idle task isn't supposed to re-enable preemption, so remove the vestigial preempt_enable() from the CPU offline path. Tested with pseries and powernv in qemu, and pseries on PowerVM.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 5.12.17v ≥ 5.13.25.10.50 ≤ v < 5.10.765.12.17 ≤ v < 5.135.13.2 ≤ v < 5.145.13.2 ≤ v < 5.14.155.14 ≤ v < 5.14.155.14 ≤ v < 5.1520a015e948b825afb47855de2efce7cae7c2608f2b6148ef2bd6d8ddc76e7873114f7769b6aa25f02c669ef6979c370f98d4b876e54f19613c81e0755.10.505.12.175.13.25.145.15 rc15.15 rc25.15 rc35.15 rc45.15 rc55.15 rc6bdf4d33e8342b90386156204e1da0cdfdb4bf146
Vendor states this is fixed in 3ea0b497a7a2fff6a4b7090310c9f52c91975934 (fixed)
Vendor states this is fixed in 53770a411559cf7bc0906d1df319cc533d2f4f58 (fixed)
Vendor states this is fixed in 787252a10d9422f3058df9a4821f389e5326c440 (fixed)
Vendor states this is fixed in 5.10.76 (unaffected)
Affected range stops below 5.13, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.14 (unaffected)
Vendor states this is fixed in 5.14.15 (unaffected)
Vendor states this is fixed in 5.15 (unaffected)

References (3)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3ea0b497a7a2fff6a4b7090310c9f52c91975934
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/53770a411559cf7bc0906d1df319cc533d2f4f58
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/787252a10d9422f3058df9a4821f389e5326c440

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card