In the Linux kernel, the following vulnerability has been resolved:
9p/transfd: always use ONONBLOCK read/write
syzbot is reporting hung task at p9fdclose() [1], for p9muxpollstop() from p9conndestroy() from p9fdclose() is failing to interrupt already started kernelread() from p9fdread() from p9readwork() and/or kernelwrite() from p9fdwrite() from p9write_work() requests.
Since p9socketopen() sets ONONBLOCK flag, p9muxpollstop() does not need to interrupt kernelread()/kernelwrite(). However, since p9fdopen() does not set ONONBLOCK flag, but pipe blocks unless signal is pending, p9muxpollstop() needs to interrupt kernelread()/kernelwrite() when the file descriptor refers to a pipe. In other words, pipe file descriptor needs to be handled as if socket file descriptor.
We somehow need to interrupt kernelread()/kernelwrite() on pipes.
A minimal change, which this patch is doing, is to set ONONBLOCK flag from p9fdopen(), for ONONBLOCK flag does not affect reading/writing of regular files. But this approach changes ONONBLOCK flag on userspace- supplied file descriptors (which might break userspace programs), and ONONBLOCK flag could be changed by userspace. It would be possible to set ONONBLOCK flag every time p9fdread()/p9fdwrite() is invoked, but still remains small race window for clearing ONONBLOCK flag.
If we don't want to manipulate ONONBLOCK flag, we might be able to surround kernelread()/kernelwrite() with setthreadflag(TIFSIGPENDING) and recalcsigpending(). Since p9readwork()/p9writework() works are processed by kernel threads which process global systemwq workqueue, signals could not be delivered from remote threads when p9muxpollstop() from p9conndestroy() from p9fdclose() is called. Therefore, calling setthreadflag(TIFSIGPENDING)/recalcsigpending() every time would be needed if we count on signals for making kernelread()/kernel_write() non-blocking.
[Dominique: add comment at Christian's suggestion]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49767.json"
}[
{
"target": {
"file": "net/9p/trans_fd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b5e6bd72b8171364616841603a70e4ba9837063",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283151848712213070574664780154119699707",
"298249935810426728602568153790086608612",
"2394327880393291860173503853917688855",
"42622411169241469416995750089372090561",
"139724685404687224760141588318588610326",
"45673489443354556668084165002368329593",
"91349470825661243543910639063010822326",
"8506584721190447582014522973422024506",
"12724417788928902402093264490789330676"
]
},
"id": "CVE-2022-49767-111acb5f",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f8554615df668e4bf83294633ee9d232b28ce45",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283151848712213070574664780154119699707",
"298249935810426728602568153790086608612",
"2394327880393291860173503853917688855",
"42622411169241469416995750089372090561",
"139724685404687224760141588318588610326",
"45673489443354556668084165002368329593",
"91349470825661243543910639063010822326",
"8506584721190447582014522973422024506",
"12724417788928902402093264490789330676"
]
},
"id": "CVE-2022-49767-1ea842db",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c",
"function": "p9_fd_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef575281b21e9a34dfae544a187c6aac2ae424a9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 619.0,
"function_hash": "121679161833954101736184587957621065867"
},
"id": "CVE-2022-49767-280159b1",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c",
"function": "p9_fd_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f8554615df668e4bf83294633ee9d232b28ce45",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 619.0,
"function_hash": "121679161833954101736184587957621065867"
},
"id": "CVE-2022-49767-36fb394f",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c",
"function": "p9_fd_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8e2fc8f7b41fa9d9ca5f624f4e4d34fce5b40a9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 619.0,
"function_hash": "121679161833954101736184587957621065867"
},
"id": "CVE-2022-49767-44d3e5b5",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7abf40f06a76c0dff42eada10597917e9776fbd4",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283151848712213070574664780154119699707",
"298249935810426728602568153790086608612",
"2394327880393291860173503853917688855",
"42622411169241469416995750089372090561",
"139724685404687224760141588318588610326",
"45673489443354556668084165002368329593",
"91349470825661243543910639063010822326",
"8506584721190447582014522973422024506",
"12724417788928902402093264490789330676"
]
},
"id": "CVE-2022-49767-4ac616c7",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e07032b4b4724b8ad1003698cb81083c1818999",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283151848712213070574664780154119699707",
"298249935810426728602568153790086608612",
"2394327880393291860173503853917688855",
"42622411169241469416995750089372090561",
"139724685404687224760141588318588610326",
"45673489443354556668084165002368329593",
"91349470825661243543910639063010822326",
"8506584721190447582014522973422024506",
"12724417788928902402093264490789330676"
]
},
"id": "CVE-2022-49767-4e8f3bf6",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c",
"function": "p9_fd_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e07032b4b4724b8ad1003698cb81083c1818999",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 619.0,
"function_hash": "121679161833954101736184587957621065867"
},
"id": "CVE-2022-49767-83b5ef87",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef575281b21e9a34dfae544a187c6aac2ae424a9",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283151848712213070574664780154119699707",
"298249935810426728602568153790086608612",
"2394327880393291860173503853917688855",
"42622411169241469416995750089372090561",
"139724685404687224760141588318588610326",
"45673489443354556668084165002368329593",
"91349470825661243543910639063010822326",
"8506584721190447582014522973422024506",
"12724417788928902402093264490789330676"
]
},
"id": "CVE-2022-49767-aeec9b66",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c",
"function": "p9_fd_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7abf40f06a76c0dff42eada10597917e9776fbd4",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 619.0,
"function_hash": "121679161833954101736184587957621065867"
},
"id": "CVE-2022-49767-bb80b497",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c",
"function": "p9_fd_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b5e6bd72b8171364616841603a70e4ba9837063",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 619.0,
"function_hash": "121679161833954101736184587957621065867"
},
"id": "CVE-2022-49767-bd00d632",
"deprecated": false
},
{
"target": {
"file": "net/9p/trans_fd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8e2fc8f7b41fa9d9ca5f624f4e4d34fce5b40a9",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283151848712213070574664780154119699707",
"298249935810426728602568153790086608612",
"2394327880393291860173503853917688855",
"42622411169241469416995750089372090561",
"139724685404687224760141588318588610326",
"45673489443354556668084165002368329593",
"91349470825661243543910639063010822326",
"8506584721190447582014522973422024506",
"12724417788928902402093264490789330676"
]
},
"id": "CVE-2022-49767-fe8b8c1e",
"deprecated": false
}
]