In the Linux kernel, the following vulnerability has been resolved:
erofs: fix pcluster use-after-free on UP platforms
During stress testing with CONFIG_SMP disabled, KASAN reports as below:
================================================================== BUG: KASAN: use-after-free in _mutexlock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789
CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. _mutexlock+0xe5/0xc30 .. zerofsdoreadpage+0x8ce/0x1560 .. zerofsreadahead+0x31c/0x580 .. Freed by task 7787 kasansavestack+0x1e/0x40 kasansettrack+0x20/0x30 kasansetfreeinfo+0x20/0x40 _kasanslabfree+0x10c/0x190 kmemcachefree+0xed/0x380 rcucore+0x3d5/0xc90 _do_softirq+0x12d/0x389
Last potentially related work creation: kasansavestack+0x1e/0x40 _kasanrecordauxstack+0x97/0xb0 callrcu+0x3d/0x3f0 erofsshrinkworkstation+0x11f/0x210 erofsshrinkscan+0xdc/0x170 shrinkslab.constprop.0+0x296/0x530 dropslab+0x1c/0x70 dropcachessysctlhandler+0x70/0x80 procsyscallhandler+0x20a/0x2f0 vfswrite+0x555/0x6c0 ksyswrite+0xbe/0x160 dosyscall_64+0x3b/0x90
The root cause is that erofsworkgroupunfreeze() doesn't reset to orig_val thus it causes a race that the pcluster reuses unexpectedly before freeing.
Since UP platforms are quite rare now, such path becomes unnecessary. Let's drop such specific-designed path directly instead.
[
{
"signature_version": "v1",
"digest": {
"function_hash": "159280074823124100250199605149818181004",
"length": 79.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "erofs_workgroup_unfreeze",
"file": "fs/erofs/internal.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94c34faaafe7b55adc2d8d881db195b646959b9e",
"id": "CVE-2022-48674-033f12fa"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "14463944617410347015492520807033306705",
"length": 151.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "erofs_wait_on_workgroup_freezed",
"file": "fs/erofs/internal.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94c34faaafe7b55adc2d8d881db195b646959b9e",
"id": "CVE-2022-48674-10199c09"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326747379330887836767328062322635006796",
"276645137314954093112246409920786025262",
"206329846853917325269114346972857192204",
"165106413100808945035958194477152228219",
"98836550821648773776891632561838317330",
"223451931009717320193677169541162378792",
"307018381966546981696484704630865965484",
"63517158792660180200213206732925762653",
"108092157164825421045497721400234545311",
"282831963989324641726079058722223333273",
"108558123949721394899931473893779984604",
"161681403957922648505660246231212630799",
"323904335128552903209653636779693919803",
"108269268750375110154021367195220657408",
"105135349804760838859480469610730392589",
"229691987902295807093865421246285726043",
"150932428986490194100880678617872599100",
"328754744066912269473026705363255646103",
"179212644389637313423333448789395238128",
"172440009851061794754722021347182727592",
"231563634557362176262788078910685474815",
"173736563970429546493158421844812758595",
"300527093972402318931717611926107137376",
"232543003105257723125744047084984444796",
"248437657477336946420177237865448337284",
"21058658921840011646638692688071358174",
"32208761216518196954312512994086041946",
"221534938209502799095047586010807076257",
"24668710501271984558138678557072111158",
"805384540691927098205573006016764019"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/erofs/internal.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94c34faaafe7b55adc2d8d881db195b646959b9e",
"id": "CVE-2022-48674-3a8b2362"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "216074371999307363502255762590443582398",
"length": 176.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "erofs_workgroup_try_to_freeze",
"file": "fs/erofs/internal.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94c34faaafe7b55adc2d8d881db195b646959b9e",
"id": "CVE-2022-48674-7f944f49"
}
]