In the Linux kernel, the following vulnerability has been resolved:
nbd: Fix hung when signal interrupts nbdstartdevice_ioctl()
syzbot reported hung task [1]. The following program is a simplified version of the reproducer:
int main(void) { int sv[2], fd;
if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0)
return 1;
if ((fd = open("/dev/nbd0", 0)) < 0)
return 1;
if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0)
return 1;
if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0)
return 1;
if (ioctl(fd, NBD_DO_IT) < 0)
return 1;
return 0;
}
When signal interrupt nbdstartdeviceioctl() waiting the condition atomicread(&config->recv_threads) == 0, the task can hung because it waits the completion of the inflight IOs.
This patch fixes the issue by clearing queue, not just shutdown, when signal interrupt nbdstartdevice_ioctl().
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/cc431b3424123d84bcd7afd4de150b33f117a8ef/cves/2022/50xxx/CVE-2022-50314.json"
}[
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3575949513ea3b387b30dac1e69468a923c86caf",
"id": "CVE-2022-50314-01399eb7",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"line_hashes": [
"189501036089876734554238198152624665092",
"103348417685611706274619349449874376336",
"65449276184701140358365722702271193088",
"235356317133403209340228571478704036335",
"197929285762016915832366309768221173950",
"21584938329084946018762613575984978289"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3575949513ea3b387b30dac1e69468a923c86caf",
"id": "CVE-2022-50314-33f68336",
"target": {
"function": "nbd_start_device_ioctl",
"file": "drivers/block/nbd.c"
},
"digest": {
"function_hash": "45393775017672675212645290490791697636",
"length": 616.0
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398",
"id": "CVE-2022-50314-53674117",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"line_hashes": [
"189501036089876734554238198152624665092",
"103348417685611706274619349449874376336",
"65449276184701140358365722702271193088",
"235356317133403209340228571478704036335",
"197929285762016915832366309768221173950",
"136447086402593809626077324130965211601"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf",
"id": "CVE-2022-50314-5fe1578d",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"line_hashes": [
"189501036089876734554238198152624665092",
"103348417685611706274619349449874376336",
"65449276184701140358365722702271193088",
"235356317133403209340228571478704036335",
"334808269056366665578127468236288488966",
"48589300464984599499574131639437141824"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1de7c3cf48fc41cd95adb12bd1ea9033a917798a",
"id": "CVE-2022-50314-6a713a16",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"line_hashes": [
"189501036089876734554238198152624665092",
"103348417685611706274619349449874376336",
"65449276184701140358365722702271193088",
"235356317133403209340228571478704036335",
"334808269056366665578127468236288488966",
"48589300464984599499574131639437141824"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ba3846cb3e2fb3c6fbf79e998472821b298419e",
"id": "CVE-2022-50314-80ccfdd7",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"line_hashes": [
"189501036089876734554238198152624665092",
"103348417685611706274619349449874376336",
"65449276184701140358365722702271193088",
"235356317133403209340228571478704036335",
"32233157781253588491411482774190041768",
"191878441931539359339734279546775025783"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2700f98b3f4dd19fb4315b70581e5caff89eb49",
"id": "CVE-2022-50314-96793588",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"line_hashes": [
"189501036089876734554238198152624665092",
"103348417685611706274619349449874376336",
"65449276184701140358365722702271193088",
"235356317133403209340228571478704036335",
"197929285762016915832366309768221173950",
"21584938329084946018762613575984978289"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1de7c3cf48fc41cd95adb12bd1ea9033a917798a",
"id": "CVE-2022-50314-96b0a2f6",
"target": {
"function": "nbd_start_device_ioctl",
"file": "drivers/block/nbd.c"
},
"digest": {
"function_hash": "155048703955147573474408429070817092185",
"length": 630.0
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398",
"id": "CVE-2022-50314-a8f71b86",
"target": {
"function": "nbd_start_device_ioctl",
"file": "drivers/block/nbd.c"
},
"digest": {
"function_hash": "216652923803382068091910500204346935327",
"length": 610.0
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62006a72b05e0d38727eef5188700f2488be5e89",
"id": "CVE-2022-50314-be3fc38f",
"target": {
"function": "nbd_start_device_ioctl",
"file": "drivers/block/nbd.c"
},
"digest": {
"function_hash": "155048703955147573474408429070817092185",
"length": 630.0
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0d73be0af8c1310713bc39a8d7a22e35084e14f",
"id": "CVE-2022-50314-d2712f9c",
"target": {
"function": "nbd_start_device_ioctl",
"file": "drivers/block/nbd.c"
},
"digest": {
"function_hash": "135452255528917132776163828971104510837",
"length": 646.0
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2700f98b3f4dd19fb4315b70581e5caff89eb49",
"id": "CVE-2022-50314-e1c8d027",
"target": {
"function": "nbd_start_device_ioctl",
"file": "drivers/block/nbd.c"
},
"digest": {
"function_hash": "135452255528917132776163828971104510837",
"length": 646.0
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ba3846cb3e2fb3c6fbf79e998472821b298419e",
"id": "CVE-2022-50314-e377f176",
"target": {
"function": "nbd_start_device_ioctl",
"file": "drivers/block/nbd.c"
},
"digest": {
"function_hash": "182238680264196716710805486555009799373",
"length": 614.0
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62006a72b05e0d38727eef5188700f2488be5e89",
"id": "CVE-2022-50314-f45b360b",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"line_hashes": [
"189501036089876734554238198152624665092",
"103348417685611706274619349449874376336",
"65449276184701140358365722702271193088",
"235356317133403209340228571478704036335",
"334808269056366665578127468236288488966",
"48589300464984599499574131639437141824"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf",
"id": "CVE-2022-50314-f568941a",
"target": {
"function": "nbd_start_device_ioctl",
"file": "drivers/block/nbd.c"
},
"digest": {
"function_hash": "155048703955147573474408429070817092185",
"length": 630.0
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0d73be0af8c1310713bc39a8d7a22e35084e14f",
"id": "CVE-2022-50314-fd53cd7a",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"line_hashes": [
"189501036089876734554238198152624665092",
"103348417685611706274619349449874376336",
"65449276184701140358365722702271193088",
"235356317133403209340228571478704036335",
"197929285762016915832366309768221173950",
"21584938329084946018762613575984978289"
],
"threshold": 0.9
},
"signature_version": "v1"
}
]