In the Linux kernel, the following vulnerability has been resolved:
RDMA/ucma: Protect mc during concurrent multicast leaves
Partially revert the commit mentioned in the Fixes line to make sure that allocation and erasing multicast struct are locked.
BUG: KASAN: use-after-free in ucmacleanupmulticast drivers/infiniband/core/ucma.c:491 [inline] BUG: KASAN: use-after-free in ucmadestroyprivatectx+0x914/0xb70 drivers/infiniband/core/ucma.c:579 Read of size 8 at addr ffff88801bb74b00 by task syz-executor.1/25529 CPU: 0 PID: 25529 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xcd/0x134 lib/dumpstack.c:106 printaddressdescription.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247 _kasanreport mm/kasan/report.c:433 [inline] kasanreport.cold+0x83/0xdf mm/kasan/report.c:450 ucmacleanupmulticast drivers/infiniband/core/ucma.c:491 [inline] ucmadestroyprivatectx+0x914/0xb70 drivers/infiniband/core/ucma.c:579 ucmadestroyid+0x1e6/0x280 drivers/infiniband/core/ucma.c:614 ucmawrite+0x25c/0x350 drivers/infiniband/core/ucma.c:1732 vfswrite+0x28e/0xae0 fs/readwrite.c:588 ksyswrite+0x1ee/0x250 fs/readwrite.c:643 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
Currently the xarray search can touch a concurrently freeing mc as the xaforeach() is not surrounded by any lock. Rather than hold the lock for a full scan hold it only for the effected items, which is usually an empty list.
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "109461504352215854073198901161384241889", "288726256777328272187354886718745586438", "200250874721577587199394947227316510004", "313701977852333943205581975620485558880", "92291237538396318292327494512074061608", "167218098908831743650246764445606497792", "263902275510144973335104387070501515074", "4974593048297909754802696970034792927", "232635322623969211241478830205735473616", "151457581941818207427903733777720132877", "114192607055221158996784455211819806995", "190396113834059664737473640629392315932", "290955844275290609860548797460743593845", "69735046602438382638409611678684010313", "209958123025787519797633615901813065974", "57734373900869511363302404063293141160", "250417513233593141096139078185704194287", "177692640394286657622374179518766033678", "96976455853893181446834946458350381899", "235549892122639332156341491243909777318", "197069940523379094769121065790279883317", "22589900548797604645165449996487914396", "191399223218663432210889543800943540835", "137111056718391886871679457159522681379", "238924488921479172433341554053150839306", "184165841024792829907013642762769852636", "33674481425854804341786637674584833004", "211466973986514052025697427219225047111", "273417656657593365123318182525659988167", "57778572093948604544176605927054906722", "138770761923554715709351683409118825063", "133202268855943196729363623545542995404", "238218874393727184158550720333780150125", "65192443627289154674207746244929180756", "17528980807616413257512608504798605685", "2957149270164045820900206031840594349", "318456537538170701615314832555230762358", "98935767764309814114456300828940357196", "112886967645980396806047999494327290749", "82211058569561722217425376055303813112", "89619088560109744268529998633705901770", "22986447025974306963463147206017069820", "123987136969086626660165237984671847825", "162367003090114702087781068548349405908", "305246074710580288651162210853562743555", "98578990322977724427742674549766384668" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36e8169ec973359f671f9ec7213547059cae972e", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c" }, "signature_type": "Line", "id": "CVE-2022-48726-2cb42ce4" }, { "signature_version": "v1", "digest": { "length": 430.0, "function_hash": "90649344114687098919317332722134091840" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75c610212b9f1756b9384911d3a2c347eee8031c", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_alloc_ctx" }, "signature_type": "Function", "id": "CVE-2022-48726-3ab46a25" }, { "signature_version": "v1", "digest": { "length": 1056.0, "function_hash": "279568564441437086113708784552762738620" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36e8169ec973359f671f9ec7213547059cae972e", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_leave_multicast" }, "signature_type": "Function", "id": "CVE-2022-48726-6f892db4" }, { "signature_version": "v1", "digest": { "length": 226.0, "function_hash": "53043868946418596090555698912593938965" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee2477e8ccd3d978eeac0dc5a981b286d9bb7b0a", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_cleanup_multicast" }, "signature_type": "Function", "id": "CVE-2022-48726-717d5fc8" }, { "signature_version": "v1", "digest": { "length": 1670.0, "function_hash": "207430315606732822852992155948179578125" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36e8169ec973359f671f9ec7213547059cae972e", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_process_join" }, "signature_type": "Function", "id": "CVE-2022-48726-79994259" }, { "signature_version": "v1", "digest": { "length": 1056.0, "function_hash": "279568564441437086113708784552762738620" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75c610212b9f1756b9384911d3a2c347eee8031c", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_leave_multicast" }, "signature_type": "Function", "id": "CVE-2022-48726-7b051366" }, { "signature_version": "v1", "digest": { "length": 1056.0, "function_hash": "279568564441437086113708784552762738620" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee2477e8ccd3d978eeac0dc5a981b286d9bb7b0a", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_leave_multicast" }, "signature_type": "Function", "id": "CVE-2022-48726-883d9e56" }, { "signature_version": "v1", "digest": { "length": 1670.0, "function_hash": "207430315606732822852992155948179578125" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75c610212b9f1756b9384911d3a2c347eee8031c", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_process_join" }, "signature_type": "Function", "id": "CVE-2022-48726-8dba040d" }, { "signature_version": "v1", "digest": { "length": 226.0, "function_hash": "53043868946418596090555698912593938965" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2923948ffe0835f7114e948b35bcc42bc9b3baa1", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_cleanup_multicast" }, "signature_type": "Function", "id": "CVE-2022-48726-9f095cde" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "109461504352215854073198901161384241889", "288726256777328272187354886718745586438", "200250874721577587199394947227316510004", "313701977852333943205581975620485558880", "92291237538396318292327494512074061608", "167218098908831743650246764445606497792", "263902275510144973335104387070501515074", "4974593048297909754802696970034792927", "232635322623969211241478830205735473616", "151457581941818207427903733777720132877", "114192607055221158996784455211819806995", "190396113834059664737473640629392315932", "290955844275290609860548797460743593845", "69735046602438382638409611678684010313", "209958123025787519797633615901813065974", "57734373900869511363302404063293141160", "250417513233593141096139078185704194287", "177692640394286657622374179518766033678", "96976455853893181446834946458350381899", "235549892122639332156341491243909777318", "197069940523379094769121065790279883317", "22589900548797604645165449996487914396", "191399223218663432210889543800943540835", "137111056718391886871679457159522681379", "238924488921479172433341554053150839306", "184165841024792829907013642762769852636", "33674481425854804341786637674584833004", "211466973986514052025697427219225047111", "273417656657593365123318182525659988167", "57778572093948604544176605927054906722", "138770761923554715709351683409118825063", "133202268855943196729363623545542995404", "238218874393727184158550720333780150125", "65192443627289154674207746244929180756", "17528980807616413257512608504798605685", "2957149270164045820900206031840594349", "318456537538170701615314832555230762358", "98935767764309814114456300828940357196", "112886967645980396806047999494327290749", "82211058569561722217425376055303813112", "89619088560109744268529998633705901770", "22986447025974306963463147206017069820", "123987136969086626660165237984671847825", "162367003090114702087781068548349405908", "305246074710580288651162210853562743555", "98578990322977724427742674549766384668" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2923948ffe0835f7114e948b35bcc42bc9b3baa1", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c" }, "signature_type": "Line", "id": "CVE-2022-48726-a37fe42c" }, { "signature_version": "v1", "digest": { "length": 226.0, "function_hash": "53043868946418596090555698912593938965" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75c610212b9f1756b9384911d3a2c347eee8031c", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_cleanup_multicast" }, "signature_type": "Function", "id": "CVE-2022-48726-af5c96ad" }, { "signature_version": "v1", "digest": { "length": 430.0, "function_hash": "90649344114687098919317332722134091840" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2923948ffe0835f7114e948b35bcc42bc9b3baa1", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_alloc_ctx" }, "signature_type": "Function", "id": "CVE-2022-48726-af8e41ce" }, { "signature_version": "v1", "digest": { "length": 430.0, "function_hash": "90649344114687098919317332722134091840" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee2477e8ccd3d978eeac0dc5a981b286d9bb7b0a", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_alloc_ctx" }, "signature_type": "Function", "id": "CVE-2022-48726-b35f5336" }, { "signature_version": "v1", "digest": { "length": 430.0, "function_hash": "90649344114687098919317332722134091840" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36e8169ec973359f671f9ec7213547059cae972e", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_alloc_ctx" }, "signature_type": "Function", "id": "CVE-2022-48726-b446b73a" }, { "signature_version": "v1", "digest": { "length": 1056.0, "function_hash": "279568564441437086113708784552762738620" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2923948ffe0835f7114e948b35bcc42bc9b3baa1", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_leave_multicast" }, "signature_type": "Function", "id": "CVE-2022-48726-ba7f0e7f" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "109461504352215854073198901161384241889", "288726256777328272187354886718745586438", "200250874721577587199394947227316510004", "313701977852333943205581975620485558880", "92291237538396318292327494512074061608", "167218098908831743650246764445606497792", "263902275510144973335104387070501515074", "4974593048297909754802696970034792927", "232635322623969211241478830205735473616", "151457581941818207427903733777720132877", "114192607055221158996784455211819806995", "190396113834059664737473640629392315932", "290955844275290609860548797460743593845", "69735046602438382638409611678684010313", "209958123025787519797633615901813065974", "57734373900869511363302404063293141160", "250417513233593141096139078185704194287", "177692640394286657622374179518766033678", "96976455853893181446834946458350381899", "235549892122639332156341491243909777318", "197069940523379094769121065790279883317", "22589900548797604645165449996487914396", "191399223218663432210889543800943540835", "137111056718391886871679457159522681379", "238924488921479172433341554053150839306", "184165841024792829907013642762769852636", "33674481425854804341786637674584833004", "211466973986514052025697427219225047111", "273417656657593365123318182525659988167", "57778572093948604544176605927054906722", "138770761923554715709351683409118825063", "133202268855943196729363623545542995404", "238218874393727184158550720333780150125", "65192443627289154674207746244929180756", "17528980807616413257512608504798605685", "2957149270164045820900206031840594349", "318456537538170701615314832555230762358", "98935767764309814114456300828940357196", "112886967645980396806047999494327290749", "82211058569561722217425376055303813112", "89619088560109744268529998633705901770", "22986447025974306963463147206017069820", "123987136969086626660165237984671847825", "162367003090114702087781068548349405908", "305246074710580288651162210853562743555", "98578990322977724427742674549766384668" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75c610212b9f1756b9384911d3a2c347eee8031c", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c" }, "signature_type": "Line", "id": "CVE-2022-48726-c136f1e3" }, { "signature_version": "v1", "digest": { "length": 226.0, "function_hash": "53043868946418596090555698912593938965" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36e8169ec973359f671f9ec7213547059cae972e", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_cleanup_multicast" }, "signature_type": "Function", "id": "CVE-2022-48726-c7bd81b7" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "109461504352215854073198901161384241889", "288726256777328272187354886718745586438", "200250874721577587199394947227316510004", "313701977852333943205581975620485558880", "92291237538396318292327494512074061608", "167218098908831743650246764445606497792", "263902275510144973335104387070501515074", "4974593048297909754802696970034792927", "232635322623969211241478830205735473616", "151457581941818207427903733777720132877", "114192607055221158996784455211819806995", "190396113834059664737473640629392315932", "290955844275290609860548797460743593845", "69735046602438382638409611678684010313", "209958123025787519797633615901813065974", "57734373900869511363302404063293141160", "250417513233593141096139078185704194287", "177692640394286657622374179518766033678", "96976455853893181446834946458350381899", "235549892122639332156341491243909777318", "197069940523379094769121065790279883317", "22589900548797604645165449996487914396", "191399223218663432210889543800943540835", "137111056718391886871679457159522681379", "238924488921479172433341554053150839306", "184165841024792829907013642762769852636", "33674481425854804341786637674584833004", "211466973986514052025697427219225047111", "273417656657593365123318182525659988167", "57778572093948604544176605927054906722", "138770761923554715709351683409118825063", "133202268855943196729363623545542995404", "238218874393727184158550720333780150125", "65192443627289154674207746244929180756", "17528980807616413257512608504798605685", "2957149270164045820900206031840594349", "318456537538170701615314832555230762358", "98935767764309814114456300828940357196", "112886967645980396806047999494327290749", "82211058569561722217425376055303813112", "89619088560109744268529998633705901770", "22986447025974306963463147206017069820", "123987136969086626660165237984671847825", "162367003090114702087781068548349405908", "305246074710580288651162210853562743555", "98578990322977724427742674549766384668" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee2477e8ccd3d978eeac0dc5a981b286d9bb7b0a", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c" }, "signature_type": "Line", "id": "CVE-2022-48726-cb0d45a2" }, { "signature_version": "v1", "digest": { "length": 1670.0, "function_hash": "207430315606732822852992155948179578125" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2923948ffe0835f7114e948b35bcc42bc9b3baa1", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_process_join" }, "signature_type": "Function", "id": "CVE-2022-48726-f8998bac" }, { "signature_version": "v1", "digest": { "length": 1670.0, "function_hash": "207430315606732822852992155948179578125" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee2477e8ccd3d978eeac0dc5a981b286d9bb7b0a", "deprecated": false, "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_process_join" }, "signature_type": "Function", "id": "CVE-2022-48726-f992625a" } ] }