cve/published/2022/CVE-2022-48921.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-48921: sched/fair: Fix fault in reweight_entity

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Fix fault in reweight_entity

Syzbot found a GPF in reweight_entity. This has been bisected to
commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid
sched_task_group")

There is a race between sched_post_fork() and setpriority(PRIO_PGRP)
within a thread group that causes a null-ptr-deref in
reweight_entity() in CFS. The scenario is that the main process spawns
number of new threads, which then call setpriority(PRIO_PGRP, 0, -20),
wait, and exit.  For each of the new threads the copy_process() gets
invoked, which adds the new task_struct and calls sched_post_fork()
for it.

In the above scenario there is a possibility that
setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread
in the group that is just being created by copy_process(), and for
which the sched_post_fork() has not been executed yet. This will
trigger a null pointer dereference in reweight_entity(), as it will
try to access the run queue pointer, which hasn't been set.

Before the mentioned change the cfs_rq pointer for the task  has been
set in sched_fork(), which is called much earlier in copy_process(),
before the new task is added to the thread_group.  Now it is done in
the sched_post_fork(), which is called after that.  To fix the issue
the remove the update_load param from the update_load param() function
and call reweight_task() only if the task flag doesn't have the
TASK_NEW flag set.

The Linux kernel CVE team has assigned CVE-2022-48921 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.80 with commit c85c6fadbef0a3eab41540ea628fa8fe8928c820 and fixed in 5.10.137 with commit 8f317cd888059c59e2fa924bf4b0957cfa53f78e
	Issue introduced in 5.15.3 with commit 3869eecf050416a1d19bac60926f6b5d64b0aa58 and fixed in 5.15.27 with commit e0bcd6b5779352aed88f2e538a82a39f1a7715bb
	Issue introduced in 5.16 with commit 4ef0c5c6b5ba1f38f0ea1cedad0cad722f00c14a and fixed in 5.16.13 with commit 589a954daab5e18399860b6c8ffaeaf79844eb20
	Issue introduced in 5.16 with commit 4ef0c5c6b5ba1f38f0ea1cedad0cad722f00c14a and fixed in 5.17 with commit 13765de8148f71fa795e0a6607de37c49ea5915a
	Issue introduced in 5.14.19 with commit 25d40b828fb855ee62e1039c65a666c9afd60786

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-48921
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/sched/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8f317cd888059c59e2fa924bf4b0957cfa53f78e
	https://git.kernel.org/stable/c/e0bcd6b5779352aed88f2e538a82a39f1a7715bb
	https://git.kernel.org/stable/c/589a954daab5e18399860b6c8ffaeaf79844eb20
	https://git.kernel.org/stable/c/13765de8148f71fa795e0a6607de37c49ea5915a