CVE-2024-46704

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix spruious data race in __flush_work()

When flushing a work item for cancellation, __flush_work() knows that it

exclusively owns the work item through its PENDING bit. 134874e2eee9

("workqueue: Allow cancel_work_sync() and disable_work() from atomic

contexts on BH work items") added a read of @work->data to determine whether

to use busy wait for BH work items that are being canceled. While the read

is safe when @from_cancel, @work->data was read before testing @from_cancel

to simplify code structure:

data = *work_data_bits(work);

if (from_cancel &&

!WARN_ON_ONCE(data & WORK_STRUCT_PWQ) && (data & WORK_OFFQ_BH)) {

While the read data was never used if !@from_cancel, this could trigger

KCSAN data race detection spuriously:

==================================================================

BUG: KCSAN: data-race in __flush_work / __flush_work

write to 0xffff8881223aa3e8 of 8 bytes by task 39

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References