cve-2022-48842
Vulnerability from cvelistv5
Published
2024-07-16 12:25
Modified
2024-12-19 08:08
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: Fix race condition during interface enslave Commit 5dbbbd01cbba83 ("ice: Avoid RTNL lock when re-creating auxiliary device") changes a process of re-creation of aux device so ice_plug_aux_dev() is called from ice_service_task() context. This unfortunately opens a race window that can result in dead-lock when interface has left LAG and immediately enters LAG again. Reproducer: ``` #!/bin/sh ip link add lag0 type bond mode 1 miimon 100 ip link set lag0 for n in {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomaster done ``` This results in: [20976.208697] Workqueue: ice ice_service_task [ice] [20976.213422] Call Trace: [20976.215871] __schedule+0x2d1/0x830 [20976.219364] schedule+0x35/0xa0 [20976.222510] schedule_preempt_disabled+0xa/0x10 [20976.227043] __mutex_lock.isra.7+0x310/0x420 [20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core] [20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core] [20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core] [20976.261079] ib_register_device+0x40d/0x580 [ib_core] [20976.266139] irdma_ib_register_device+0x129/0x250 [irdma] [20976.281409] irdma_probe+0x2c1/0x360 [irdma] [20976.285691] auxiliary_bus_probe+0x45/0x70 [20976.289790] really_probe+0x1f2/0x480 [20976.298509] driver_probe_device+0x49/0xc0 [20976.302609] bus_for_each_drv+0x79/0xc0 [20976.306448] __device_attach+0xdc/0x160 [20976.310286] bus_probe_device+0x9d/0xb0 [20976.314128] device_add+0x43c/0x890 [20976.321287] __auxiliary_device_add+0x43/0x60 [20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice] [20976.330109] ice_service_task+0xd0c/0xed0 [ice] [20976.342591] process_one_work+0x1a7/0x360 [20976.350536] worker_thread+0x30/0x390 [20976.358128] kthread+0x10a/0x120 [20976.365547] ret_from_fork+0x1f/0x40 ... [20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084 [20976.446469] Call Trace: [20976.448921] __schedule+0x2d1/0x830 [20976.452414] schedule+0x35/0xa0 [20976.455559] schedule_preempt_disabled+0xa/0x10 [20976.460090] __mutex_lock.isra.7+0x310/0x420 [20976.464364] device_del+0x36/0x3c0 [20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice] [20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice] [20976.477288] notifier_call_chain+0x47/0x70 [20976.481386] __netdev_upper_dev_link+0x18b/0x280 [20976.489845] bond_enslave+0xe05/0x1790 [bonding] [20976.494475] do_setlink+0x336/0xf50 [20976.502517] __rtnl_newlink+0x529/0x8b0 [20976.543441] rtnl_newlink+0x43/0x60 [20976.546934] rtnetlink_rcv_msg+0x2b1/0x360 [20976.559238] netlink_rcv_skb+0x4c/0x120 [20976.563079] netlink_unicast+0x196/0x230 [20976.567005] netlink_sendmsg+0x204/0x3d0 [20976.570930] sock_sendmsg+0x4c/0x50 [20976.574423] ____sys_sendmsg+0x1eb/0x250 [20976.586807] ___sys_sendmsg+0x7c/0xc0 [20976.606353] __sys_sendmsg+0x57/0xa0 [20976.609930] do_syscall_64+0x5b/0x1a0 [20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xca 1. Command 'ip link ... set nomaster' causes that ice_plug_aux_dev() is called from ice_service_task() context, aux device is created and associated device->lock is taken. 2. Command 'ip link ... set master...' calls ice's notifier under RTNL lock and that notifier calls ice_unplug_aux_dev(). That function tries to take aux device->lock but this is already taken by ice_plug_aux_dev() in step 1 3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already taken in step 2 4. Dead-lock The patch fixes this issue by following changes: - Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev() call in ice_service_task() - The bit is checked in ice_clear_rdma_cap() and only if it is not set then ice_unplug_aux_dev() is called. If it is set (in other words plugging of aux device was requested and ice_plug_aux_dev() is potentially running) then the function only clears the ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbcMailing List, Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49efMailing List, Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dcMailing List, Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbcMailing List, Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49efMailing List, Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dcMailing List, Patch
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
   Linux Linux Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.534Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:56:50.883714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:09.633Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a9bbacc53d1f5ed8febbfdf31401d20e005f49ef",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e1014fc5572375658fa421531cedb6e084f477dc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5cb1ebdbc4342b1c2ce89516e19808d64417bdbc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix race condition during interface enslave\n\nCommit 5dbbbd01cbba83 (\"ice: Avoid RTNL lock when re-creating\nauxiliary device\") changes a process of re-creation of aux device\nso ice_plug_aux_dev() is called from ice_service_task() context.\nThis unfortunately opens a race window that can result in dead-lock\nwhen interface has left LAG and immediately enters LAG again.\n\nReproducer:\n```\n#!/bin/sh\n\nip link add lag0 type bond mode 1 miimon 100\nip link set lag0\n\nfor n in {1..10}; do\n        echo Cycle: $n\n        ip link set ens7f0 master lag0\n        sleep 1\n        ip link set ens7f0 nomaster\ndone\n```\n\nThis results in:\n[20976.208697] Workqueue: ice ice_service_task [ice]\n[20976.213422] Call Trace:\n[20976.215871]  __schedule+0x2d1/0x830\n[20976.219364]  schedule+0x35/0xa0\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\n[20976.289790]  really_probe+0x1f2/0x480\n[20976.298509]  driver_probe_device+0x49/0xc0\n[20976.302609]  bus_for_each_drv+0x79/0xc0\n[20976.306448]  __device_attach+0xdc/0x160\n[20976.310286]  bus_probe_device+0x9d/0xb0\n[20976.314128]  device_add+0x43c/0x890\n[20976.321287]  __auxiliary_device_add+0x43/0x60\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\n[20976.342591]  process_one_work+0x1a7/0x360\n[20976.350536]  worker_thread+0x30/0x390\n[20976.358128]  kthread+0x10a/0x120\n[20976.365547]  ret_from_fork+0x1f/0x40\n...\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\n[20976.446469] Call Trace:\n[20976.448921]  __schedule+0x2d1/0x830\n[20976.452414]  schedule+0x35/0xa0\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\n[20976.464364]  device_del+0x36/0x3c0\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\n[20976.477288]  notifier_call_chain+0x47/0x70\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\n[20976.494475]  do_setlink+0x336/0xf50\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\n[20976.543441]  rtnl_newlink+0x43/0x60\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\n[20976.563079]  netlink_unicast+0x196/0x230\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\n[20976.570930]  sock_sendmsg+0x4c/0x50\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\n[20976.606353]  __sys_sendmsg+0x57/0xa0\n[20976.609930]  do_syscall_64+0x5b/0x1a0\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n1. Command \u0027ip link ... set nomaster\u0027 causes that ice_plug_aux_dev()\n   is called from ice_service_task() context, aux device is created\n   and associated device-\u003elock is taken.\n2. Command \u0027ip link ... set master...\u0027 calls ice\u0027s notifier under\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\n   function tries to take aux device-\u003elock but this is already taken\n   by ice_plug_aux_dev() in step 1\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\n   taken in step 2\n4. Dead-lock\n\nThe patch fixes this issue by following changes:\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\n  call in ice_service_task()\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\n  then ice_unplug_aux_dev() is called. If it is set (in other words\n  plugging of aux device was requested and ice_plug_aux_dev() is\n  potentially running) then the function only clears the\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:08:47.188Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc"
        }
      ],
      "title": "ice: Fix race condition during interface enslave",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48842",
    "datePublished": "2024-07-16T12:25:12.499Z",
    "dateReserved": "2024-07-16T11:38:08.910Z",
    "dateUpdated": "2024-12-19T08:08:47.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48842\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T13:15:11.577\",\"lastModified\":\"2024-11-21T07:34:11.560\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Fix race condition during interface enslave\\n\\nCommit 5dbbbd01cbba83 (\\\"ice: Avoid RTNL lock when re-creating\\nauxiliary device\\\") changes a process of re-creation of aux device\\nso ice_plug_aux_dev() is called from ice_service_task() context.\\nThis unfortunately opens a race window that can result in dead-lock\\nwhen interface has left LAG and immediately enters LAG again.\\n\\nReproducer:\\n```\\n#!/bin/sh\\n\\nip link add lag0 type bond mode 1 miimon 100\\nip link set lag0\\n\\nfor n in {1..10}; do\\n        echo Cycle: $n\\n        ip link set ens7f0 master lag0\\n        sleep 1\\n        ip link set ens7f0 nomaster\\ndone\\n```\\n\\nThis results in:\\n[20976.208697] Workqueue: ice ice_service_task [ice]\\n[20976.213422] Call Trace:\\n[20976.215871]  __schedule+0x2d1/0x830\\n[20976.219364]  schedule+0x35/0xa0\\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\\n[20976.289790]  really_probe+0x1f2/0x480\\n[20976.298509]  driver_probe_device+0x49/0xc0\\n[20976.302609]  bus_for_each_drv+0x79/0xc0\\n[20976.306448]  __device_attach+0xdc/0x160\\n[20976.310286]  bus_probe_device+0x9d/0xb0\\n[20976.314128]  device_add+0x43c/0x890\\n[20976.321287]  __auxiliary_device_add+0x43/0x60\\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\\n[20976.342591]  process_one_work+0x1a7/0x360\\n[20976.350536]  worker_thread+0x30/0x390\\n[20976.358128]  kthread+0x10a/0x120\\n[20976.365547]  ret_from_fork+0x1f/0x40\\n...\\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\\n[20976.446469] Call Trace:\\n[20976.448921]  __schedule+0x2d1/0x830\\n[20976.452414]  schedule+0x35/0xa0\\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\\n[20976.464364]  device_del+0x36/0x3c0\\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\\n[20976.477288]  notifier_call_chain+0x47/0x70\\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\\n[20976.494475]  do_setlink+0x336/0xf50\\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\\n[20976.543441]  rtnl_newlink+0x43/0x60\\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\\n[20976.563079]  netlink_unicast+0x196/0x230\\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\\n[20976.570930]  sock_sendmsg+0x4c/0x50\\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\\n[20976.606353]  __sys_sendmsg+0x57/0xa0\\n[20976.609930]  do_syscall_64+0x5b/0x1a0\\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\\n\\n1. Command \u0027ip link ... set nomaster\u0027 causes that ice_plug_aux_dev()\\n   is called from ice_service_task() context, aux device is created\\n   and associated device-\u003elock is taken.\\n2. Command \u0027ip link ... set master...\u0027 calls ice\u0027s notifier under\\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\\n   function tries to take aux device-\u003elock but this is already taken\\n   by ice_plug_aux_dev() in step 1\\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\\n   taken in step 2\\n4. Dead-lock\\n\\nThe patch fixes this issue by following changes:\\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\\n  call in ice_service_task()\\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\\n  then ice_unplug_aux_dev() is called. If it is set (in other words\\n  plugging of aux device was requested and ice_plug_aux_dev() is\\n  potentially running) then the function only clears the\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: corrige la condici\u00f3n de ejecuci\u00f3n durante la esclavitud de la interfaz. El commit 5dbbbd01cbba83 (\\\"ice: evita el bloqueo RTNL al recrear el dispositivo auxiliar\\\") cambia el proceso de recreaci\u00f3n del dispositivo auxiliar para que ice_plug_aux_dev( ) se llama desde el contexto ice_service_task(). Desafortunadamente, esto abre una ventana de ejecuci\u00f3n que puede resultar en un punto muerto cuando la interfaz sale de LAG e inmediatamente ingresa a LAG nuevamente. Reproductor: ``` #!/bin/sh enlace ip agregar lag0 tipo modo de enlace 1 miimon 100 enlace ip configurar lag0 para n en {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomaster done ``` Esto da como resultado: [20976.208697] Cola de trabajo: ice ice_service_task [ice] [20976.213422] Seguimiento de llamadas: [20976.215871] __schedule+0x2d1/ 0x830 [20976.219364] programaci\u00f3n+0x35/0xa0 [20976.222510] programaci\u00f3n_preempt_disabled+0xa/0x10 [20976.227043] __mutex_lock.isra.7+0x310/0x420 [20976.235071] enum_all_gids_of_de v_cb+0x1c/0x100 [ib_core] [20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core ] [20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core] [20976.261079] ib_register_device+0x40d/0x580 [ib_core] [20976.266139] irdma_ib_register_device+0x129/0x250 [irdma] 0976.281409] irdma_probe+0x2c1/0x360 [irdma] [20976.285691] sonda_bus_auxiliar+ 0x45/0x70 [20976.289790] very_probe+0x1f2/0x480 [20976.298509] driver_probe_device+0x49/0xc0 [20976.302609] bus_for_each_drv+0x79/0xc0 [20976.306448] adjuntar+0xdc/0x160 [20976.310286] bus_probe_device+0x9d/0xb0 [20976.314128] dispositivo_add+0x43c/ 0x890 [20976.321287] __auxiliary_device_add+0x43/0x60 [20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice] [20976.330109] ice_service_task+0xd0c/0xed0 [ice] 1] proceso_un_trabajo+0x1a7/0x360 [20976.350536] hilo_trabajador+0x30/0x390 [20976.358128] kthread+0x10a/0x120 [20976.365547] ret_from_fork+0x1f/0x40 ... [20976.438030] tarea:ip estado:D pila: 0 pid:213658 ppid:213627 banderas:0x00004084 [20976.446469] Seguimiento de llamadas: 76.448921] __programaci\u00f3n+0x2d1/ 0x830 [20976.452414] programaci\u00f3n+0x35/0xa0 [20976.455559] programaci\u00f3n_preempt_disabled+0xa/0x10 [20976.460090] __mutex_lock.isra.7+0x310/0x420 [20976.464364 dispositivo_del+0x36/0x 3c0 [20976.467772] ice_unplug_aux_dev+0x1a/0x40 [hielo] [20976.472313 ] ice_lag_event_handler+0x2a2/0x520 [ice] [20976.477288] notifier_call_chain+0x47/0x70 [20976.481386] __netdev_upper_dev_link+0x18b/0x280 [20976.489845] bond_enslave+0xe05/0 x1790 [vinculaci\u00f3n] [20976.494475] do_setlink+0x336/0xf50 [20976.502517] __rtnl_newlink+0x529 /0x8b0 [20976.543441] rtnl_newlink+0x43/0x60 [20976.546934] rtnetlink_rcv_msg+0x2b1/0x360 [20976.559238] netlink_rcv_skb+0x4c/0x120 [20976.563079] _unicast+0x196/0x230 [20976.567005] netlink_sendmsg+0x204/0x3d0 [20976.570930] sock_sendmsg+0x4c/0x50 [20976.574423] ____sys_sendmsg+0x1eb/0x250 [20976.586807] ___sys_sendmsg+0x7c/0xc0 [20976.606353] __sys_sendmsg+0x57/0xa0 [20976.609930] call_64+0x5b/0x1a0 [20976.613598] Entry_SYSCALL_64_after_hwframe+0x65/0xca 1. Comando \u0027ip link... set nomaster\u0027 provoca que se llame a ice_plug_aux_dev() desde el contexto ice_service_task(), se crea el dispositivo auxiliar y se toma el dispositivo asociado-\u0026gt;bloqueo. 2. El comando \u0027ip link... set master...\u0027 llama al notificador de ice bajo bloqueo RTNL y ese notificador llama a ice_unplug_aux_dev(). Esa funci\u00f3n intenta tomar el dispositivo auxiliar-\u0026gt;bloqueo, pero esto ya lo tom\u00f3 ice_plug_aux_dev() en el paso 1 3. M\u00e1s tarde, ice_plug_aux_dev() intenta tomar el bloqueo RTNL pero esto ya lo tom\u00f3 en el paso 2 4. Bloqueo muerto El parche soluciona esto problema mediante los siguientes cambios: - El bit ICE_FLAG_PLUG_AUX_DEV se mantiene configurado durante la llamada a ice_plug_aux_dev() en ice_service_task() - El bit se verifica en ice_clear_rdma_cap() y solo si no est\u00e1 configurado, se llama a ice_unplug_aux_dev(). l ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"},{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.30\",\"matchCriteriaId\":\"B4DCE220-813A-4393-8BEF-C705DCD12175\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.16\",\"matchCriteriaId\":\"EDF25425-C006-411E-B842-0F12075B8C13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2D2677C-5389-4AE9-869D-0F881E80D923\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFA3917C-C322-4D92-912D-ECE45B2E7416\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"BED18363-5ABC-4639-8BBA-68E771E5BB3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F635F96-FA0A-4769-ADE8-232B3AC9116D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD39FE73-2A9D-4C92-AE7A-CA22F84B228D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.534Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48842\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:56:50.883714Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.038Z\"}}], \"cna\": {\"title\": \"ice: Fix race condition during interface enslave\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"a9bbacc53d1f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"e1014fc55723\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"5cb1ebdbc434\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice.h\", \"drivers/net/ethernet/intel/ice/ice_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.15.30\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice.h\", \"drivers/net/ethernet/intel/ice/ice_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\"}, {\"url\": \"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\"}, {\"url\": \"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Fix race condition during interface enslave\\n\\nCommit 5dbbbd01cbba83 (\\\"ice: Avoid RTNL lock when re-creating\\nauxiliary device\\\") changes a process of re-creation of aux device\\nso ice_plug_aux_dev() is called from ice_service_task() context.\\nThis unfortunately opens a race window that can result in dead-lock\\nwhen interface has left LAG and immediately enters LAG again.\\n\\nReproducer:\\n```\\n#!/bin/sh\\n\\nip link add lag0 type bond mode 1 miimon 100\\nip link set lag0\\n\\nfor n in {1..10}; do\\n        echo Cycle: $n\\n        ip link set ens7f0 master lag0\\n        sleep 1\\n        ip link set ens7f0 nomaster\\ndone\\n```\\n\\nThis results in:\\n[20976.208697] Workqueue: ice ice_service_task [ice]\\n[20976.213422] Call Trace:\\n[20976.215871]  __schedule+0x2d1/0x830\\n[20976.219364]  schedule+0x35/0xa0\\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\\n[20976.289790]  really_probe+0x1f2/0x480\\n[20976.298509]  driver_probe_device+0x49/0xc0\\n[20976.302609]  bus_for_each_drv+0x79/0xc0\\n[20976.306448]  __device_attach+0xdc/0x160\\n[20976.310286]  bus_probe_device+0x9d/0xb0\\n[20976.314128]  device_add+0x43c/0x890\\n[20976.321287]  __auxiliary_device_add+0x43/0x60\\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\\n[20976.342591]  process_one_work+0x1a7/0x360\\n[20976.350536]  worker_thread+0x30/0x390\\n[20976.358128]  kthread+0x10a/0x120\\n[20976.365547]  ret_from_fork+0x1f/0x40\\n...\\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\\n[20976.446469] Call Trace:\\n[20976.448921]  __schedule+0x2d1/0x830\\n[20976.452414]  schedule+0x35/0xa0\\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\\n[20976.464364]  device_del+0x36/0x3c0\\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\\n[20976.477288]  notifier_call_chain+0x47/0x70\\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\\n[20976.494475]  do_setlink+0x336/0xf50\\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\\n[20976.543441]  rtnl_newlink+0x43/0x60\\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\\n[20976.563079]  netlink_unicast+0x196/0x230\\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\\n[20976.570930]  sock_sendmsg+0x4c/0x50\\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\\n[20976.606353]  __sys_sendmsg+0x57/0xa0\\n[20976.609930]  do_syscall_64+0x5b/0x1a0\\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\\n\\n1. Command \u0027ip link ... set nomaster\u0027 causes that ice_plug_aux_dev()\\n   is called from ice_service_task() context, aux device is created\\n   and associated device-\u003elock is taken.\\n2. Command \u0027ip link ... set master...\u0027 calls ice\u0027s notifier under\\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\\n   function tries to take aux device-\u003elock but this is already taken\\n   by ice_plug_aux_dev() in step 1\\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\\n   taken in step 2\\n4. Dead-lock\\n\\nThe patch fixes this issue by following changes:\\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\\n  call in ice_service_task()\\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\\n  then ice_unplug_aux_dev() is called. If it is set (in other words\\n  plugging of aux device was requested and ice_plug_aux_dev() is\\n  potentially running) then the function only clears the\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-04T12:17:38.739Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48842\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-04T12:17:38.739Z\", \"dateReserved\": \"2024-07-16T11:38:08.910Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T12:25:12.499Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.