| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49759: VMCI: Use threaded irqs instead of tasklets |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| VMCI: Use threaded irqs instead of tasklets |
| |
| The vmci_dispatch_dgs() tasklet function calls vmci_read_data() |
| which uses wait_event() resulting in invalid sleep in an atomic |
| context (and therefore potentially in a deadlock). |
| |
| Use threaded irqs to fix this issue and completely remove usage |
| of tasklets. |
| |
| [ 20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145 |
| [ 20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd |
| [ 20.264645] preempt_count: 101, expected: 0 |
| [ 20.264646] RCU nest depth: 0, expected: 0 |
| [ 20.264647] 1 lock held by vmtoolsd/762: |
| [ 20.264648] #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock] |
| [ 20.264658] Preemption disabled at: |
| [ 20.264659] [<ffff80000151d7d8>] vmci_send_datagram+0x44/0xa0 [vmw_vmci] |
| [ 20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1 |
| [ 20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020 |
| [ 20.264668] Call trace: |
| [ 20.264669] dump_backtrace+0xc4/0x130 |
| [ 20.264672] show_stack+0x24/0x80 |
| [ 20.264673] dump_stack_lvl+0x88/0xb4 |
| [ 20.264676] dump_stack+0x18/0x34 |
| [ 20.264677] __might_resched+0x1a0/0x280 |
| [ 20.264679] __might_sleep+0x58/0x90 |
| [ 20.264681] vmci_read_data+0x74/0x120 [vmw_vmci] |
| [ 20.264683] vmci_dispatch_dgs+0x64/0x204 [vmw_vmci] |
| [ 20.264686] tasklet_action_common.constprop.0+0x13c/0x150 |
| [ 20.264688] tasklet_action+0x40/0x50 |
| [ 20.264689] __do_softirq+0x23c/0x6b4 |
| [ 20.264690] __irq_exit_rcu+0x104/0x214 |
| [ 20.264691] irq_exit_rcu+0x1c/0x50 |
| [ 20.264693] el1_interrupt+0x38/0x6c |
| [ 20.264695] el1h_64_irq_handler+0x18/0x24 |
| [ 20.264696] el1h_64_irq+0x68/0x6c |
| [ 20.264697] preempt_count_sub+0xa4/0xe0 |
| [ 20.264698] _raw_spin_unlock_irqrestore+0x64/0xb0 |
| [ 20.264701] vmci_send_datagram+0x7c/0xa0 [vmw_vmci] |
| [ 20.264703] vmci_datagram_dispatch+0x84/0x100 [vmw_vmci] |
| [ 20.264706] vmci_datagram_send+0x2c/0x40 [vmw_vmci] |
| [ 20.264709] vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport] |
| [ 20.264711] vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport] |
| [ 20.264713] vsock_connect+0x278/0x330 [vsock] |
| [ 20.264715] __sys_connect_file+0x8c/0xc0 |
| [ 20.264718] __sys_connect+0x84/0xb4 |
| [ 20.264720] __arm64_sys_connect+0x2c/0x3c |
| [ 20.264721] invoke_syscall+0x78/0x100 |
| [ 20.264723] el0_svc_common.constprop.0+0x68/0x124 |
| [ 20.264724] do_el0_svc+0x38/0x4c |
| [ 20.264725] el0_svc+0x60/0x180 |
| [ 20.264726] el0t_64_sync_handler+0x11c/0x150 |
| [ 20.264728] el0t_64_sync+0x190/0x194 |
| |
| The Linux kernel CVE team has assigned CVE-2022-49759 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.18 with commit 463713eb6164b6577f8e91447c7745628215531b and fixed in 6.1.8 with commit 548ea9dd5e01b0ecf53d2563004c80abd636743d |
| Issue introduced in 5.18 with commit 463713eb6164b6577f8e91447c7745628215531b and fixed in 6.2 with commit 3daed6345d5880464f46adab871d208e1baa2f3a |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49759 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/misc/vmw_vmci/vmci_guest.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/548ea9dd5e01b0ecf53d2563004c80abd636743d |
| https://git.kernel.org/stable/c/3daed6345d5880464f46adab871d208e1baa2f3a |
