cve/published/2022/CVE-2022-49193.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49193: ice: fix 'scheduling while atomic' on aux critical err interrupt

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ice: fix 'scheduling while atomic' on aux critical err interrupt

There's a kernel BUG splat on processing aux critical error
interrupts in ice_misc_intr():

[ 2100.917085] BUG: scheduling while atomic: swapper/15/0/0x00010000
...
[ 2101.060770] Call Trace:
[ 2101.063229]  <IRQ>
[ 2101.065252]  dump_stack+0x41/0x60
[ 2101.068587]  __schedule_bug.cold.100+0x4c/0x58
[ 2101.073060]  __schedule+0x6a4/0x830
[ 2101.076570]  schedule+0x35/0xa0
[ 2101.079727]  schedule_preempt_disabled+0xa/0x10
[ 2101.084284]  __mutex_lock.isra.7+0x310/0x420
[ 2101.088580]  ? ice_misc_intr+0x201/0x2e0 [ice]
[ 2101.093078]  ice_send_event_to_aux+0x25/0x70 [ice]
[ 2101.097921]  ice_misc_intr+0x220/0x2e0 [ice]
[ 2101.102232]  __handle_irq_event_percpu+0x40/0x180
[ 2101.106965]  handle_irq_event_percpu+0x30/0x80
[ 2101.111434]  handle_irq_event+0x36/0x53
[ 2101.115292]  handle_edge_irq+0x82/0x190
[ 2101.119148]  handle_irq+0x1c/0x30
[ 2101.122480]  do_IRQ+0x49/0xd0
[ 2101.125465]  common_interrupt+0xf/0xf
[ 2101.129146]  </IRQ>
...

As Andrew correctly mentioned previously[0], the following call
ladder happens:

ice_misc_intr() <- hardirq
  ice_send_event_to_aux()
    device_lock()
      mutex_lock()
        might_sleep()
          might_resched() <- oops

Add a new PF state bit which indicates that an aux critical error
occurred and serve it in ice_service_task() in process context.
The new ice_pf::oicr_err_reg is read-write in both hardirq and
process contexts, but only 3 bits of non-critical data probably
aren't worth explicit synchronizing (and they're even in the same
byte [31:24]).

[0] https://lore.kernel.org/all/YeSRUVmrdmlUXHDn@lunn.ch

The Linux kernel CVE team has assigned CVE-2022-49193 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit 348048e724a0e8f08b63948d728d27596f6d3769 and fixed in 5.15.33 with commit 9b77c8cf69a41d1e3851370aeaa04a9ea83b865c
	Issue introduced in 5.14 with commit 348048e724a0e8f08b63948d728d27596f6d3769 and fixed in 5.16.19 with commit 24d7ac8426306ae7ccea7f7dd612a7368fe7201d
	Issue introduced in 5.14 with commit 348048e724a0e8f08b63948d728d27596f6d3769 and fixed in 5.17.2 with commit 59e88a50afad7469c55804e46bf2924b9130281f
	Issue introduced in 5.14 with commit 348048e724a0e8f08b63948d728d27596f6d3769 and fixed in 5.18 with commit 32d53c0aa3a7b727243473949bad2a830b908edc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49193
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/intel/ice/ice.h
	drivers/net/ethernet/intel/ice/ice_main.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9b77c8cf69a41d1e3851370aeaa04a9ea83b865c
	https://git.kernel.org/stable/c/24d7ac8426306ae7ccea7f7dd612a7368fe7201d
	https://git.kernel.org/stable/c/59e88a50afad7469c55804e46bf2924b9130281f
	https://git.kernel.org/stable/c/32d53c0aa3a7b727243473949bad2a830b908edc