In the Linux kernel, the following vulnerability has been resolved:
configfs: fix a race in configfs{,un}registersubsystem()
When configfsregistersubsystem() or configfsunregistersubsystem() is executing linkgroup() or unlinkgroup(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic.
One of cases is: A --> B --> C --> D A <-- B <-- C <-- D
delete list_head *B | delete list_head *C
--------------------------------|----------------------------------- configfsunregistersubsystem | configfsunregistersubsystem unlinkgroup | unlinkgroup unlinkobj | unlinkobj listdelinit | listdelinit _listdelentry | _listdelentry _listdel | _listdel // next == C | next->prev = prev | | next->prev = prev prev->next = next | | // prev == B | prev->next = next
Fix this by adding mutex when calling linkgroup() or unlinkgroup(), but parent configfssubsystem is NULL when configitem is root. So I create a mutex configfssubsystemmutex.
[
{
"digest": {
"length": 994.0,
"function_hash": "263520933466275241523042563865557475279"
},
"signature_type": "Function",
"target": {
"function": "configfs_register_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7a66dd2687758718eddd79b542a95cf3aa488cc",
"signature_version": "v1",
"id": "CVE-2022-48931-0c8e7d2a"
},
{
"digest": {
"length": 994.0,
"function_hash": "263520933466275241523042563865557475279"
},
"signature_type": "Function",
"target": {
"function": "configfs_register_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37024f7757c25550accdebf49e497ad6ae239fe",
"signature_version": "v1",
"id": "CVE-2022-48931-1d53656f"
},
{
"digest": {
"length": 994.0,
"function_hash": "263520933466275241523042563865557475279"
},
"signature_type": "Function",
"target": {
"function": "configfs_register_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aadfd46858b1f64d4d6a0654b863e21aabff975",
"signature_version": "v1",
"id": "CVE-2022-48931-246d86a0"
},
{
"digest": {
"length": 1017.0,
"function_hash": "274523032151593249879043129122446882222"
},
"signature_type": "Function",
"target": {
"function": "configfs_unregister_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a",
"signature_version": "v1",
"id": "CVE-2022-48931-24ccadcf"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"297672345667087298675128453428280988330",
"271911867683268735259509564590635507498",
"6901571406321767635100680582347081081",
"190129434915784100217993888264149306690",
"231778525611109711081271597189102981935",
"155360938877246913675536314789251234741",
"46817294419632197511835822510370466469",
"172341757817590707759573120234751576173",
"158060896900736909732016286454434540298",
"45067846798559983074017285900661477829",
"260011366217802904640592111292722715085",
"167517781398092828843252963869618586121",
"192325398882326453355926944755549025815",
"306942097150452500529053909484840977064",
"302682721047439465326146433783629582428",
"168289111033906057483510663736453556327",
"276038178827798712628610949065127605405"
]
},
"signature_type": "Line",
"target": {
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a",
"signature_version": "v1",
"id": "CVE-2022-48931-29000c78"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"297672345667087298675128453428280988330",
"271911867683268735259509564590635507498",
"6901571406321767635100680582347081081",
"190129434915784100217993888264149306690",
"231778525611109711081271597189102981935",
"155360938877246913675536314789251234741",
"46817294419632197511835822510370466469",
"172341757817590707759573120234751576173",
"158060896900736909732016286454434540298",
"45067846798559983074017285900661477829",
"260011366217802904640592111292722715085",
"167517781398092828843252963869618586121",
"192325398882326453355926944755549025815",
"306942097150452500529053909484840977064",
"302682721047439465326146433783629582428",
"168289111033906057483510663736453556327",
"276038178827798712628610949065127605405"
]
},
"signature_type": "Line",
"target": {
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7a66dd2687758718eddd79b542a95cf3aa488cc",
"signature_version": "v1",
"id": "CVE-2022-48931-32248425"
},
{
"digest": {
"length": 994.0,
"function_hash": "263520933466275241523042563865557475279"
},
"signature_type": "Function",
"target": {
"function": "configfs_register_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a",
"signature_version": "v1",
"id": "CVE-2022-48931-346fa482"
},
{
"digest": {
"length": 1017.0,
"function_hash": "274523032151593249879043129122446882222"
},
"signature_type": "Function",
"target": {
"function": "configfs_unregister_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7a66dd2687758718eddd79b542a95cf3aa488cc",
"signature_version": "v1",
"id": "CVE-2022-48931-37906dda"
},
{
"digest": {
"length": 994.0,
"function_hash": "263520933466275241523042563865557475279"
},
"signature_type": "Function",
"target": {
"function": "configfs_register_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7ab53d3c27dfe83bb594456b9f38a37796ec39b",
"signature_version": "v1",
"id": "CVE-2022-48931-39ce260e"
},
{
"digest": {
"length": 979.0,
"function_hash": "326464914729535279520742951136074819820"
},
"signature_type": "Function",
"target": {
"function": "configfs_unregister_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1654de19d42f513b6cfe955cc77e7f427e05a77",
"signature_version": "v1",
"id": "CVE-2022-48931-3d8f914b"
},
{
"digest": {
"length": 979.0,
"function_hash": "326464914729535279520742951136074819820"
},
"signature_type": "Function",
"target": {
"function": "configfs_unregister_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37024f7757c25550accdebf49e497ad6ae239fe",
"signature_version": "v1",
"id": "CVE-2022-48931-45e31202"
},
{
"digest": {
"length": 979.0,
"function_hash": "326464914729535279520742951136074819820"
},
"signature_type": "Function",
"target": {
"function": "configfs_unregister_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@40805099af11f68c5ca7dbcfacf455da8f99f622",
"signature_version": "v1",
"id": "CVE-2022-48931-53cec793"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"297672345667087298675128453428280988330",
"271911867683268735259509564590635507498",
"6901571406321767635100680582347081081",
"190129434915784100217993888264149306690",
"231778525611109711081271597189102981935",
"155360938877246913675536314789251234741",
"46817294419632197511835822510370466469",
"172341757817590707759573120234751576173",
"158060896900736909732016286454434540298",
"45067846798559983074017285900661477829",
"260011366217802904640592111292722715085",
"167517781398092828843252963869618586121",
"192325398882326453355926944755549025815",
"306942097150452500529053909484840977064",
"302682721047439465326146433783629582428",
"168289111033906057483510663736453556327",
"276038178827798712628610949065127605405"
]
},
"signature_type": "Line",
"target": {
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aadfd46858b1f64d4d6a0654b863e21aabff975",
"signature_version": "v1",
"id": "CVE-2022-48931-616809f7"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169902262147069169610684428715513355609",
"45606038391471552897220872198301595611",
"6901571406321767635100680582347081081",
"190129434915784100217993888264149306690",
"231778525611109711081271597189102981935",
"155360938877246913675536314789251234741",
"46817294419632197511835822510370466469",
"172341757817590707759573120234751576173",
"158060896900736909732016286454434540298",
"45067846798559983074017285900661477829",
"260011366217802904640592111292722715085",
"167517781398092828843252963869618586121",
"192325398882326453355926944755549025815",
"190706189268605493596349470630912892150",
"302682721047439465326146433783629582428",
"168289111033906057483510663736453556327",
"276038178827798712628610949065127605405"
]
},
"signature_type": "Line",
"target": {
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@40805099af11f68c5ca7dbcfacf455da8f99f622",
"signature_version": "v1",
"id": "CVE-2022-48931-680661ef"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169902262147069169610684428715513355609",
"45606038391471552897220872198301595611",
"6901571406321767635100680582347081081",
"190129434915784100217993888264149306690",
"231778525611109711081271597189102981935",
"155360938877246913675536314789251234741",
"46817294419632197511835822510370466469",
"172341757817590707759573120234751576173",
"158060896900736909732016286454434540298",
"45067846798559983074017285900661477829",
"260011366217802904640592111292722715085",
"167517781398092828843252963869618586121",
"192325398882326453355926944755549025815",
"190706189268605493596349470630912892150",
"302682721047439465326146433783629582428",
"168289111033906057483510663736453556327",
"276038178827798712628610949065127605405"
]
},
"signature_type": "Line",
"target": {
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37024f7757c25550accdebf49e497ad6ae239fe",
"signature_version": "v1",
"id": "CVE-2022-48931-766248b3"
},
{
"digest": {
"length": 1017.0,
"function_hash": "274523032151593249879043129122446882222"
},
"signature_type": "Function",
"target": {
"function": "configfs_unregister_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aadfd46858b1f64d4d6a0654b863e21aabff975",
"signature_version": "v1",
"id": "CVE-2022-48931-93887584"
},
{
"digest": {
"length": 1017.0,
"function_hash": "274523032151593249879043129122446882222"
},
"signature_type": "Function",
"target": {
"function": "configfs_unregister_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7ab53d3c27dfe83bb594456b9f38a37796ec39b",
"signature_version": "v1",
"id": "CVE-2022-48931-9495cae6"
},
{
"digest": {
"length": 994.0,
"function_hash": "263520933466275241523042563865557475279"
},
"signature_type": "Function",
"target": {
"function": "configfs_register_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1654de19d42f513b6cfe955cc77e7f427e05a77",
"signature_version": "v1",
"id": "CVE-2022-48931-c7e26249"
},
{
"digest": {
"length": 1017.0,
"function_hash": "274523032151593249879043129122446882222"
},
"signature_type": "Function",
"target": {
"function": "configfs_unregister_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84ec758fb2daa236026506868c8796b0500c047d",
"signature_version": "v1",
"id": "CVE-2022-48931-da9ababb"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"297672345667087298675128453428280988330",
"271911867683268735259509564590635507498",
"6901571406321767635100680582347081081",
"190129434915784100217993888264149306690",
"231778525611109711081271597189102981935",
"155360938877246913675536314789251234741",
"46817294419632197511835822510370466469",
"172341757817590707759573120234751576173",
"158060896900736909732016286454434540298",
"45067846798559983074017285900661477829",
"260011366217802904640592111292722715085",
"167517781398092828843252963869618586121",
"192325398882326453355926944755549025815",
"306942097150452500529053909484840977064",
"302682721047439465326146433783629582428",
"168289111033906057483510663736453556327",
"276038178827798712628610949065127605405"
]
},
"signature_type": "Line",
"target": {
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7ab53d3c27dfe83bb594456b9f38a37796ec39b",
"signature_version": "v1",
"id": "CVE-2022-48931-db4505c0"
},
{
"digest": {
"length": 994.0,
"function_hash": "263520933466275241523042563865557475279"
},
"signature_type": "Function",
"target": {
"function": "configfs_register_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84ec758fb2daa236026506868c8796b0500c047d",
"signature_version": "v1",
"id": "CVE-2022-48931-dc841899"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"297672345667087298675128453428280988330",
"271911867683268735259509564590635507498",
"6901571406321767635100680582347081081",
"190129434915784100217993888264149306690",
"231778525611109711081271597189102981935",
"155360938877246913675536314789251234741",
"46817294419632197511835822510370466469",
"172341757817590707759573120234751576173",
"158060896900736909732016286454434540298",
"45067846798559983074017285900661477829",
"260011366217802904640592111292722715085",
"167517781398092828843252963869618586121",
"192325398882326453355926944755549025815",
"306942097150452500529053909484840977064",
"302682721047439465326146433783629582428",
"168289111033906057483510663736453556327",
"276038178827798712628610949065127605405"
]
},
"signature_type": "Line",
"target": {
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84ec758fb2daa236026506868c8796b0500c047d",
"signature_version": "v1",
"id": "CVE-2022-48931-e213f2f1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169902262147069169610684428715513355609",
"45606038391471552897220872198301595611",
"6901571406321767635100680582347081081",
"190129434915784100217993888264149306690",
"231778525611109711081271597189102981935",
"155360938877246913675536314789251234741",
"46817294419632197511835822510370466469",
"172341757817590707759573120234751576173",
"158060896900736909732016286454434540298",
"45067846798559983074017285900661477829",
"260011366217802904640592111292722715085",
"167517781398092828843252963869618586121",
"192325398882326453355926944755549025815",
"190706189268605493596349470630912892150",
"302682721047439465326146433783629582428",
"168289111033906057483510663736453556327",
"276038178827798712628610949065127605405"
]
},
"signature_type": "Line",
"target": {
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1654de19d42f513b6cfe955cc77e7f427e05a77",
"signature_version": "v1",
"id": "CVE-2022-48931-e49f25ce"
},
{
"digest": {
"length": 994.0,
"function_hash": "263520933466275241523042563865557475279"
},
"signature_type": "Function",
"target": {
"function": "configfs_register_subsystem",
"file": "fs/configfs/dir.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@40805099af11f68c5ca7dbcfacf455da8f99f622",
"signature_version": "v1",
"id": "CVE-2022-48931-ed99d2cf"
}
]