In the Linux kernel, the following vulnerability has been resolved:
ice: arfs: fix use-after-free when freeing @rxcpurmap
The CI testing bots triggered the following splat:
[ 718.203054] BUG: KASAN: use-after-free in freeirqcpurmap+0x53/0x80 [ 718.206349] Read of size 4 at addr ffff8881bd127e00 by task sh/20834 [ 718.212852] CPU: 28 PID: 20834 Comm: sh Kdump: loaded Tainted: G S W IOE 5.17.0-rc8nextqueue-devqueue-02643-g23f3121aca93 #1 [ 718.219695] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0012.070720200218 07/07/2020 [ 718.223418] Call Trace: [ 718.227139] [ 718.230783] dumpstacklvl+0x33/0x42 [ 718.234431] printaddressdescription.constprop.9+0x21/0x170 [ 718.238177] ? freeirqcpurmap+0x53/0x80 [ 718.241885] ? freeirqcpurmap+0x53/0x80 [ 718.245539] kasanreport.cold.18+0x7f/0x11b [ 718.249197] ? freeirqcpurmap+0x53/0x80 [ 718.252852] freeirqcpurmap+0x53/0x80 [ 718.256471] icefreecpurxrmap.part.11+0x37/0x50 [ice] [ 718.260174] iceremovearfs+0x5f/0x70 [ice] [ 718.263810] icerebuildarfs+0x3b/0x70 [ice] [ 718.267419] icerebuild+0x39c/0xb60 [ice] [ 718.270974] ? asmsysvecapictimerinterrupt+0x12/0x20 [ 718.274472] ? iceinitphyusercfg+0x360/0x360 [ice] [ 718.278033] ? delaytsc+0x4a/0xb0 [ 718.281513] ? preemptcountsub+0x14/0xc0 [ 718.284984] ? delaytsc+0x8f/0xb0 [ 718.288463] icedoreset+0x92/0xf0 [ice] [ 718.292014] icepcierrresume+0x91/0xf0 [ice] [ 718.295561] pcireset_function+0x53/0x80 <...> [ 718.393035] Allocated by task 690: [ 718.433497] Freed by task 20834: [ 718.495688] Last potentially related work creation: [ 718.568966] The buggy address belongs to the object at ffff8881bd127e00 which belongs to the cache kmalloc-96 of size 96 [ 718.574085] The buggy address is located 0 bytes inside of 96-byte region [ffff8881bd127e00, ffff8881bd127e60) [ 718.579265] The buggy address belongs to the page: [ 718.598905] Memory state around the buggy address: [ 718.601809] ffff8881bd127d00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 718.604796] ffff8881bd127d80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 718.607794] >ffff8881bd127e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 718.610811] ^ [ 718.613819] ffff8881bd127e80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 718.617107] ffff8881bd127f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
This is due to that freeirqcpurmap() is always being called *after* (devm)freeirq() and thus it tries to work with IRQ descs already freed. For example, on device reset the driver frees the rmap right before allocating a new one (the splat above). Make rmap creation and freeing function symmetrical with {request,free}irq() calls i.e. do that on ifup/ifdown instead of device probe/remove/resume. These operations can be performed independently from the actual device aRFS configuration. Also, make sure icevsifree_irq() clears IRQ affinity notifiers only when aRFS is disabled -- otherwise, CPU rmap sets and clears its own and they must not be touched manually.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"134228091339409557927306656902554662849",
"301918970521590851670039628538239635696",
"195735416530150533601113674371290739696",
"153640886939428981262082435081308483962",
"50246096699224182575612494045857309772",
"156790169682851776971453078044364178091",
"338985112699803876568944031704462306359",
"269932436617834065970029034758121841262",
"106742843383664423649700076938998653279",
"197845563068329128331362184681885245548",
"246228362402251512925125030283993140323",
"320907855097574209879033911796648255929",
"185873562125141285006308919579121052992",
"206384379192758685016741269328711111149",
"306381913260363693035519055670564476307",
"28916952720557631595402510961488650994",
"691020714549866957221297586459942042",
"295378402011664177668605470085913076532",
"339324503923084851139683588983656767771",
"97032774095994312753812696330130432159",
"35021853303103380336564785441795661135",
"211005767301289926465165681993143250122"
]
},
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-0d9374bf"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250239367775352590990005510785402468305",
"22303323412845220670327043736116246009",
"12991009611476227126267932620884801441",
"55765722580343393475686077840623565553",
"127351855912032116596042514439061248105",
"329773559869926410397863411557256597688",
"319626419057879118052146126625762486666",
"152683264049898740350133601391812432083",
"164995034280847316359723103134091640921",
"316744314240093135549541696962492113107",
"199248155859053986178995119359916546133",
"25273245446933713800270802960630657391",
"287372338996621142599233040168064025023",
"16469573868547185574260753288193624203",
"135361936062417960884256248081088632393",
"248359061044779326957418178883837390028",
"115273099595942147926167588302373969464",
"213336000611475465737176200010660929867"
]
},
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-0e339fd5"
},
{
"signature_type": "Function",
"digest": {
"length": 1171.0,
"function_hash": "2156206947898649931858568667350729024"
},
"target": {
"function": "ice_setup_pf_sw",
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-0e5334c9"
},
{
"signature_type": "Function",
"digest": {
"length": 1696.0,
"function_hash": "338628533407799693818812820232871573597"
},
"target": {
"function": "ice_vsi_req_irq_msix",
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-1db59900"
},
{
"signature_type": "Function",
"digest": {
"length": 917.0,
"function_hash": "73309437680387509098483405407024585150"
},
"target": {
"function": "ice_suspend",
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-241e30f1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"134228091339409557927306656902554662849",
"301918970521590851670039628538239635696",
"195735416530150533601113674371290739696",
"153640886939428981262082435081308483962",
"50246096699224182575612494045857309772",
"156790169682851776971453078044364178091",
"338985112699803876568944031704462306359",
"269932436617834065970029034758121841262",
"106742843383664423649700076938998653279",
"197845563068329128331362184681885245548",
"246228362402251512925125030283993140323",
"320907855097574209879033911796648255929",
"185873562125141285006308919579121052992",
"206384379192758685016741269328711111149",
"306381913260363693035519055670564476307",
"28916952720557631595402510961488650994",
"691020714549866957221297586459942042",
"295378402011664177668605470085913076532",
"339324503923084851139683588983656767771",
"97032774095994312753812696330130432159",
"35021853303103380336564785441795661135",
"211005767301289926465165681993143250122"
]
},
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-451a97dc"
},
{
"signature_type": "Function",
"digest": {
"length": 671.0,
"function_hash": "298047991653279298739751240175986836860"
},
"target": {
"function": "ice_vsi_free_irq",
"file": "drivers/net/ethernet/intel/ice/ice_lib.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-62e91766"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47877151727713660351035889835850795741",
"218421572501346758957979226861499020121",
"25012768968217827093075428775086765783",
"127954643163566497220639287575985238156",
"247529684594451500448504889594348472074",
"287375710614333587025474478202400506016",
"202895485731516295733194730656380586240",
"73663481531947943174249490267115324797"
]
},
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_lib.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-640a88f5"
},
{
"signature_type": "Function",
"digest": {
"length": 263.0,
"function_hash": "52576126426452794093141393853172307224"
},
"target": {
"function": "ice_free_cpu_rx_rmap",
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-66501639"
},
{
"signature_type": "Function",
"digest": {
"length": 239.0,
"function_hash": "106619992937576413869918523701527499238"
},
"target": {
"function": "ice_rebuild_arfs",
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-807ada7c"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47877151727713660351035889835850795741",
"218421572501346758957979226861499020121",
"25012768968217827093075428775086765783",
"127954643163566497220639287575985238156",
"247529684594451500448504889594348472074",
"287375710614333587025474478202400506016",
"202895485731516295733194730656380586240",
"73663481531947943174249490267115324797"
]
},
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_lib.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-931e019b"
},
{
"signature_type": "Function",
"digest": {
"length": 137.0,
"function_hash": "218047327019694951853355279485408989687"
},
"target": {
"function": "ice_remove_arfs",
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-93c10e8a"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250239367775352590990005510785402468305",
"22303323412845220670327043736116246009",
"12991009611476227126267932620884801441",
"55765722580343393475686077840623565553",
"127351855912032116596042514439061248105",
"329773559869926410397863411557256597688",
"319626419057879118052146126625762486666",
"152683264049898740350133601391812432083",
"164995034280847316359723103134091640921",
"316744314240093135549541696962492113107",
"199248155859053986178995119359916546133",
"25273245446933713800270802960630657391",
"287372338996621142599233040168064025023",
"16469573868547185574260753288193624203",
"135361936062417960884256248081088632393",
"248359061044779326957418178883837390028",
"115273099595942147926167588302373969464",
"213336000611475465737176200010660929867"
]
},
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-c5f6b799"
},
{
"signature_type": "Function",
"digest": {
"length": 715.0,
"function_hash": "235430900130507857250322472639932242826"
},
"target": {
"function": "ice_set_cpu_rx_rmap",
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-d2b8c154"
},
{
"signature_type": "Function",
"digest": {
"length": 1675.0,
"function_hash": "165388518904875949360392338316181292560"
},
"target": {
"function": "ice_vsi_req_irq_msix",
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-de6bf619"
},
{
"signature_type": "Function",
"digest": {
"length": 239.0,
"function_hash": "106619992937576413869918523701527499238"
},
"target": {
"function": "ice_rebuild_arfs",
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-e49bc9ed"
},
{
"signature_type": "Function",
"digest": {
"length": 671.0,
"function_hash": "298047991653279298739751240175986836860"
},
"target": {
"function": "ice_vsi_free_irq",
"file": "drivers/net/ethernet/intel/ice/ice_lib.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-e4dc5420"
},
{
"signature_type": "Function",
"digest": {
"length": 1046.0,
"function_hash": "193649611739209838916373236773234412524"
},
"target": {
"function": "ice_setup_pf_sw",
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-ec4d3a49"
},
{
"signature_type": "Function",
"digest": {
"length": 917.0,
"function_hash": "73309437680387509098483405407024585150"
},
"target": {
"function": "ice_suspend",
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-ed507dbb"
},
{
"signature_type": "Function",
"digest": {
"length": 137.0,
"function_hash": "218047327019694951853355279485408989687"
},
"target": {
"function": "ice_remove_arfs",
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-edbf1564"
},
{
"signature_type": "Function",
"digest": {
"length": 715.0,
"function_hash": "235430900130507857250322472639932242826"
},
"target": {
"function": "ice_set_cpu_rx_rmap",
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7442f512b71fc63a99c8a801422dde4fbbf9f93",
"id": "CVE-2022-49063-f065592c"
},
{
"signature_type": "Function",
"digest": {
"length": 263.0,
"function_hash": "52576126426452794093141393853172307224"
},
"target": {
"function": "ice_free_cpu_rx_rmap",
"file": "drivers/net/ethernet/intel/ice/ice_arfs.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3",
"id": "CVE-2022-49063-f7e01f4d"
}
]