CVE-2022-50475

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Make sure "ib_port" is valid when access sysfs node

The "ibport" structure must be set before adding the sysfs kobject, and reset after removing it, otherwise it may crash when accessing the sysfs node: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Mem abort info: ESR = 0x96000006 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000e85f5ba5 [0000000000000050] pgd=0000000848fd9003, pud=000000085b387003, pmd=0000000000000000 Internal error: Oops: 96000006 [#2] PREEMPT SMP Modules linked in: ibumad(O) mlx5ib(O) nfnetlinkcttimeout(E) nfnetlink(E) actgact(E) clsflower(E) schingress(E) openvswitch(E) nsh(E) nfnatipv6(E) nfnatipv4(E) nfconncount(E) nfnat(E) nfconntrack(E) nfdefragipv6(E) nfdefragipv4(E) mstpciconf(O) ipmidevintf(E) ipmimsghandler(E) ipmbdevint(OE) mlx5core(O) mlxfw(O) mlxdevm(O) auxiliary(O) ibuverbs(O) ibcore(O) mlxcompat(O) psample(E) sbsagwdt(E) uiopdrvgenirq(E) uio(E) mlxbfpmc(OE) mlxbfgige(OE) mlxbftmfifo(OE) gpiomlxbf2(OE) pwrmlxbf(OE) mlxtrio(OE) i2cmlxbf(OE) mlxbootctl(OE) bluefieldedac(OE) knem(O) iptables(E) ipv6(E) crcccitt(E) [last unloaded: mstpci] Process grep (pid: 3372, stack limit = 0x0000000022055c92) CPU: 5 PID: 3372 Comm: grep Tainted: G D OE 4.19.161-mlnx.47.gadcd9e3 #1 Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS BlueField:3.9.2-15-ga2403ab Sep 8 2022 pstate: 40000005 (nZcv daif -PAN -UAO) pc : hwstatportshow+0x4c/0x80 [ibcore] lr : portattrshow+0x40/0x58 [ibcore] sp : ffff000029f43b50 x29: ffff000029f43b50 x28: 0000000019375000 x27: ffff8007b821a540 x26: ffff000029f43e30 x25: 0000000000008000 x24: ffff000000eaa958 x23: 0000000000001000 x22: ffff8007a4ce3000 x21: ffff8007baff8000 x20: ffff8007b9066ac0 x19: ffff8007bae97578 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff8007a4ce4000 x7 : 0000000000000000 x6 : 000000000000003f x5 : ffff000000e6a280 x4 : ffff8007a4ce3000 x3 : 0000000000000000 x2 : aaaaaaaaaaaaaaab x1 : ffff8007b9066a10 x0 : ffff8007baff8000 Call trace: hwstatportshow+0x4c/0x80 [ibcore] portattrshow+0x40/0x58 [ibcore] sysfskfseqshow+0x8c/0x150 kernfsseqshow+0x44/0x50 seqread+0x1b4/0x45c kernfsfopread+0x148/0x1d8 _vfsread+0x58/0x180 vfsread+0x94/0x154 ksysread+0x68/0xd8 _arm64sysread+0x28/0x34 el0svccommon+0x88/0x18c el0svchandler+0x78/0x94 el0svc+0x8/0xe8 Code: f2955562 aa1603e4 aa1503e0 f9405683 (f9402861)