Linux cgroup freezer: lock inversion between cpu_hotplug_lock and freezer_mutex can deadlock

Impact

After the core freezer rewrite, freezer_apply_state() takes cpu_hotplug_lock while already holding freezer_mutex, while the cgroup attach path takes them in the opposite order. A workload that writes to cgroup v1 freezer state concurrently with task migration can deadlock those locks. On a GPU node this is a hang in the cgroup machinery the container runtime drives on every pod start and stop, so the node stops accepting or releasing work and has to be rebooted - expensive on a box with long-running training jobs. Availability only; no memory corruption or information disclosure is described.

Who can reach it

Local. Needs write access to cgroup v1 freezer files plus concurrent task attachment - normally the container runtime or a privileged process, not an unprivileged tenant inside a pod.

What to do

Patch the host kernel to a stable release that moves cpus_read_lock() outside freezer_mutex, then drain and reboot the node. Hosts on cgroup v2 only are not affected by the freezer v1 path.

References

Related entries

• Linux vdpa: missing netlink attribute policy allows out-of-bounds read on vdpa configCVE-2023-53543 · Linux kernel vdpa netlink interface (missing nla_policy for max vqp attribute)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2023-53552 · Linux i915 GPU kernel driverHigh
• Linux kernel LIO iSCSI target: per-connection configfs output overflows the buffer with enough sessionsCVE-2023-53676 · Linux kernel iSCSI target (LIO lio_target_nacl_info_show configfs output)High
• Linux kernel arm64 SME: fixed 8-byte FFR clear corrupts memory past the SVE context structCVE-2023-53713 · Linux kernel arm64 SME signal/context save (FFR field clear)High
• Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed andCVE-2023-53781 · Linux kernel (net/smc)High
• Linux kernel bpf: reused slab objects leave htab special fields stale, causing hard lockupCVE-2023-53790 · Linux kernel BPF memory allocator (non-preallocated htab map values)High