cve/published/2022/CVE-2022-49152.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49152: XArray: Fix xas_create_range() when multi-order entry present

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

XArray: Fix xas_create_range() when multi-order entry present

If there is already an entry present that is of order >= XA_CHUNK_SHIFT
when we call xas_create_range(), xas_create_range() will misinterpret
that entry as a node and dereference xa_node->parent, generally leading
to a crash that looks something like this:

general protection fault, probably for non-canonical address 0xdffffc0000000001:
0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 32 Comm: khugepaged Not tainted 5.17.0-rc8-syzkaller-00003-g56e337f2cf13 #0
RIP: 0010:xa_parent_locked include/linux/xarray.h:1207 [inline]
RIP: 0010:xas_create_range+0x2d9/0x6e0 lib/xarray.c:725

It's deterministically reproducable once you know what the problem is,
but producing it in a live kernel requires khugepaged to hit a race.
While the problem has been present since xas_create_range() was
introduced, I'm not aware of a way to hit it before the page cache was
converted to use multi-index entries.

The Linux kernel CVE team has assigned CVE-2022-49152 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 5.4.189 with commit 3e2852eda19ee1a400cd809d7a9322680f34a262
	Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 5.10.110 with commit 1ac49c8fd49fdf53d3cd8b77eb8ffda08d7fbe22
	Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 5.15.33 with commit 7521a97b1929042604bef6859f62fa8b4bbc077b
	Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 5.16.19 with commit 29968329b926d238e3107ec071a250397555d264
	Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 5.17.2 with commit 18f13edf3424b3b61814b69d5269b2e14584800c
	Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 5.18 with commit 3e3c658055c002900982513e289398a1aad4a488

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49152
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	lib/test_xarray.c
	lib/xarray.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3e2852eda19ee1a400cd809d7a9322680f34a262
	https://git.kernel.org/stable/c/1ac49c8fd49fdf53d3cd8b77eb8ffda08d7fbe22
	https://git.kernel.org/stable/c/7521a97b1929042604bef6859f62fa8b4bbc077b
	https://git.kernel.org/stable/c/29968329b926d238e3107ec071a250397555d264
	https://git.kernel.org/stable/c/18f13edf3424b3b61814b69d5269b2e14584800c
	https://git.kernel.org/stable/c/3e3c658055c002900982513e289398a1aad4a488