In the Linux kernel, the following vulnerability has been resolved:
ice: fix concurrent reset and removal of VFs
Commit c503e63200c6 ("ice: Stop processing VF messages during teardown") introduced a driver state flag, ICEVFDEINITINPROGRESS, which is intended to prevent some issues with concurrently handling messages from VFs while tearing down the VFs.
This change was motivated by crashes caused while tearing down and bringing up VFs in rapid succession.
It turns out that the fix actually introduces issues with the VF driver caused because the PF no longer responds to any messages sent by the VF during its .remove routine. This results in the VF potentially removing its DMA memory before the PF has shut down the device queues.
Additionally, the fix doesn't actually resolve concurrency issues within the ice driver. It is possible for a VF to initiate a reset just prior to the ice driver removing VFs. This can result in the remove task concurrently operating while the VF is being reset. This results in similar memory corruption and panics purportedly fixed by that commit.
Fix this concurrency at its root by protecting both the reset and removal flows using the existing VF cfg_lock. This ensures that we cannot remove the VF while any outstanding critical tasks such as a virtchnl message or a reset are occurring.
This locking change also fixes the root cause originally fixed by commit c503e63200c6 ("ice: Stop processing VF messages during teardown"), so we can simply revert it.
Note that I kept these two changes together because simply reverting the original commit alone would leave the driver vulnerable to worse race conditions.
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 1367.0, "function_hash": "174431375956625328650624858576726658738" }, "id": "CVE-2022-48941-013ca7fa", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_reset_all_vfs" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 4206.0, "function_hash": "251125208675861953708705999886819467430" }, "id": "CVE-2022-48941-0281519c", "target": { "file": "drivers/net/ethernet/intel/ice/ice_main.c", "function": "ice_handle_mdd_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 4206.0, "function_hash": "251125208675861953708705999886819467430" }, "id": "CVE-2022-48941-08331e77", "target": { "file": "drivers/net/ethernet/intel/ice/ice_main.c", "function": "ice_handle_mdd_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 498.0, "function_hash": "95479920564085753285767968455068084393" }, "id": "CVE-2022-48941-09709495", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_process_vflr_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 382.0, "function_hash": "264046358900354594992709274611558721328" }, "id": "CVE-2022-48941-0bc702f7", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_vf_lan_overflow_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 498.0, "function_hash": "95479920564085753285767968455068084393" }, "id": "CVE-2022-48941-0c7cc5b7", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_process_vflr_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 498.0, "function_hash": "95479920564085753285767968455068084393" }, "id": "CVE-2022-48941-14393247", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_process_vflr_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "297973391512446821684095073857883649639", "279741030714184488039524244439251005685", "206644696177612462186542982132568598120", "201294841344692728662684891608264826695", "88682694997381565705469727838969706171" ] }, "id": "CVE-2022-48941-490c351a", "target": { "file": "drivers/net/ethernet/intel/ice/ice_main.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 1994.0, "function_hash": "250665960841900786865923427764363519792" }, "id": "CVE-2022-48941-4a46b47b", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_reset_vf" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 1677.0, "function_hash": "290229456431613343693183011113981112421" }, "id": "CVE-2022-48941-55d91e55", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_free_vfs" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 1698.0, "function_hash": "316338948563702369333297742444074925505" }, "id": "CVE-2022-48941-60887614", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_free_vfs" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 4206.0, "function_hash": "251125208675861953708705999886819467430" }, "id": "CVE-2022-48941-60cffd47", "target": { "file": "drivers/net/ethernet/intel/ice/ice_main.c", "function": "ice_handle_mdd_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 382.0, "function_hash": "264046358900354594992709274611558721328" }, "id": "CVE-2022-48941-6dba7b8c", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_vf_lan_overflow_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 382.0, "function_hash": "264046358900354594992709274611558721328" }, "id": "CVE-2022-48941-7e055564", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_vf_lan_overflow_event" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 2029.0, "function_hash": "133509601088590542944761919669851640687" }, "id": "CVE-2022-48941-8ada524b", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_reset_vf" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "171724445314667359168315492759403668466", "211909282627295210386707080738815622466", "88944152510616944356543122484220781724", "136235385630730220363568571838488942079" ] }, "id": "CVE-2022-48941-8b34501f", "target": { "file": "drivers/net/ethernet/intel/ice/ice.h" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 1267.0, "function_hash": "325137458209454778740755826861976282334" }, "id": "CVE-2022-48941-8d21c76f", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_reset_all_vfs" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 3671.0, "function_hash": "1320213962872211627695306779773572954" }, "id": "CVE-2022-48941-8d78edf6", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_vc_process_vf_msg" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 1698.0, "function_hash": "316338948563702369333297742444074925505" }, "id": "CVE-2022-48941-8f0354f5", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_free_vfs" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "114257732298104465380786409706391402505", "16418329118019765550314461288607343745", "153488540220351517980715226297802894068", "57545552436877895112271503723697585396", "133595961079171242187455314198458331865", "264504163575018225774645894619957590381", "119912084628565264002023585211896338848", "314897571704844823291166527971892380055", "246546385717593305024973735903219254055", "101741693109293452883908662592089100078", "136371583952017861737141420507278899959", "93964143896251277767964141640121106899", "281237515452976104348605495346676895396", "204193746499654905157589326795066007658", "260143532079536070789952816297626055531", "255490195846529834159441875455492270039", "8343861839276003592854345044947252726", "176130116183710034378223231060498532824", "269069515297643216515964115306574701724", "69803010566780911838872632762615955071", "24247437279379475469646923142865173226", "265309301795781276548955491470657857783", "24356724516142346603604479318459562310", "151053674733205232644818112299573784486", "263415785789342126551056364212764205395", "50077289611448858107215381335192635318", "38365450460111393614489726270268023719", "16751472314445251959843190909044243117", "135666506473509809094327350378158555675", "226591304405545071060517353880252840443", "87201032270537250539745441056008575236", "56841287337406311074532035286173149677", "299958397048767102836088740698874455922", "157686918816854449102528336293729258971", "89286650306424128371424385321273903265", "308525500860582839674656083094133299425", "125758117572468834869436303992910865658", "29556979109184436364264730812016403653", "201557358821379428671481148689943611668", "269155870293745226659206547162047326927", "41408191453770275727077710496472898485", "194671249648308891468733551013972950488", "97529837343020497006299438538591285278", "65575620776995880367325364921316549784", "274448003956253862431217076370826439638", "240949050909273358240736759580485799067", "114422963336380470083753775632862660663" ] }, "id": "CVE-2022-48941-a0fea926", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 3671.0, "function_hash": "1320213962872211627695306779773572954" }, "id": "CVE-2022-48941-a122c5d6", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_vc_process_vf_msg" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 3333.0, "function_hash": "330034546403489919328856063946369275302" }, "id": "CVE-2022-48941-a632896f", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_vc_process_vf_msg" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 1367.0, "function_hash": "174431375956625328650624858576726658738" }, "id": "CVE-2022-48941-ab72ec9f", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_reset_all_vfs" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 1948.0, "function_hash": "62214224980331092528354490547871969167" }, "id": "CVE-2022-48941-bd09562d", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c", "function": "ice_reset_vf" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "171724445314667359168315492759403668466", "211909282627295210386707080738815622466", "88944152510616944356543122484220781724", "136235385630730220363568571838488942079" ] }, "id": "CVE-2022-48941-d3efe89c", "target": { "file": "drivers/net/ethernet/intel/ice/ice.h" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "114257732298104465380786409706391402505", "16418329118019765550314461288607343745", "153488540220351517980715226297802894068", "213070464058190012554948192866424731720", "133595961079171242187455314198458331865", "264504163575018225774645894619957590381", "119912084628565264002023585211896338848", "314897571704844823291166527971892380055", "246546385717593305024973735903219254055", "101741693109293452883908662592089100078", "136371583952017861737141420507278899959", "93964143896251277767964141640121106899", "281237515452976104348605495346676895396", "204193746499654905157589326795066007658", "260143532079536070789952816297626055531", "255490195846529834159441875455492270039", "8343861839276003592854345044947252726", "176130116183710034378223231060498532824", "269069515297643216515964115306574701724", "69803010566780911838872632762615955071", "24247437279379475469646923142865173226", "265309301795781276548955491470657857783", "24356724516142346603604479318459562310", "151053674733205232644818112299573784486", "263415785789342126551056364212764205395", "50077289611448858107215381335192635318", "38365450460111393614489726270268023719", "16751472314445251959843190909044243117", "52727290103933719987602819699518175763", "30742408385408607662336605098054623114", "87201032270537250539745441056008575236", "56841287337406311074532035286173149677", "299958397048767102836088740698874455922", "157686918816854449102528336293729258971", "89286650306424128371424385321273903265", "308525500860582839674656083094133299425", "125758117572468834869436303992910865658", "29556979109184436364264730812016403653", "201557358821379428671481148689943611668", "269155870293745226659206547162047326927", "41408191453770275727077710496472898485", "194671249648308891468733551013972950488", "97529837343020497006299438538591285278", "65575620776995880367325364921316549784", "274448003956253862431217076370826439638", "240949050909273358240736759580485799067", "114422963336380470083753775632862660663" ] }, "id": "CVE-2022-48941-df9290fe", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "114257732298104465380786409706391402505", "16418329118019765550314461288607343745", "153488540220351517980715226297802894068", "57545552436877895112271503723697585396", "133595961079171242187455314198458331865", "264504163575018225774645894619957590381", "119912084628565264002023585211896338848", "314897571704844823291166527971892380055", "246546385717593305024973735903219254055", "101741693109293452883908662592089100078", "136371583952017861737141420507278899959", "93964143896251277767964141640121106899", "281237515452976104348605495346676895396", "204193746499654905157589326795066007658", "260143532079536070789952816297626055531", "255490195846529834159441875455492270039", "8343861839276003592854345044947252726", "176130116183710034378223231060498532824", "269069515297643216515964115306574701724", "69803010566780911838872632762615955071", "24247437279379475469646923142865173226", "265309301795781276548955491470657857783", "24356724516142346603604479318459562310", "151053674733205232644818112299573784486", "263415785789342126551056364212764205395", "50077289611448858107215381335192635318", "38365450460111393614489726270268023719", "16751472314445251959843190909044243117", "135666506473509809094327350378158555675", "226591304405545071060517353880252840443", "87201032270537250539745441056008575236", "56841287337406311074532035286173149677", "299958397048767102836088740698874455922", "157686918816854449102528336293729258971", "89286650306424128371424385321273903265", "308525500860582839674656083094133299425", "125758117572468834869436303992910865658", "29556979109184436364264730812016403653", "201557358821379428671481148689943611668", "269155870293745226659206547162047326927", "41408191453770275727077710496472898485", "194671249648308891468733551013972950488", "97529837343020497006299438538591285278", "65575620776995880367325364921316549784", "274448003956253862431217076370826439638", "240949050909273358240736759580485799067", "114422963336380470083753775632862660663" ] }, "id": "CVE-2022-48941-dfac0d90", "target": { "file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "171724445314667359168315492759403668466", "211909282627295210386707080738815622466", "88944152510616944356543122484220781724", "136235385630730220363568571838488942079" ] }, "id": "CVE-2022-48941-f46fe9f8", "target": { "file": "drivers/net/ethernet/intel/ice/ice.h" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "297973391512446821684095073857883649639", "279741030714184488039524244439251005685", "206644696177612462186542982132568598120", "201294841344692728662684891608264826695", "88682694997381565705469727838969706171" ] }, "id": "CVE-2022-48941-f5e7387f", "target": { "file": "drivers/net/ethernet/intel/ice/ice_main.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "297973391512446821684095073857883649639", "279741030714184488039524244439251005685", "206644696177612462186542982132568598120", "201294841344692728662684891608264826695", "88682694997381565705469727838969706171" ] }, "id": "CVE-2022-48941-fb55789b", "target": { "file": "drivers/net/ethernet/intel/ice/ice_main.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957" } ] }