In the Linux kernel, the following vulnerability has been resolved:
erofs: fix pcluster use-after-free on UP platforms
During stress testing with CONFIG_SMP disabled, KASAN reports as below:
================================================================== BUG: KASAN: use-after-free in _mutexlock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789
CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. _mutexlock+0xe5/0xc30 .. zerofsdoreadpage+0x8ce/0x1560 .. zerofsreadahead+0x31c/0x580 .. Freed by task 7787 kasansavestack+0x1e/0x40 kasansettrack+0x20/0x30 kasansetfreeinfo+0x20/0x40 _kasanslabfree+0x10c/0x190 kmemcachefree+0xed/0x380 rcucore+0x3d5/0xc90 _do_softirq+0x12d/0x389
Last potentially related work creation: kasansavestack+0x1e/0x40 _kasanrecordauxstack+0x97/0xb0 callrcu+0x3d/0x3f0 erofsshrinkworkstation+0x11f/0x210 erofsshrinkscan+0xdc/0x170 shrinkslab.constprop.0+0x296/0x530 dropslab+0x1c/0x70 dropcachessysctlhandler+0x70/0x80 procsyscallhandler+0x20a/0x2f0 vfswrite+0x555/0x6c0 ksyswrite+0xbe/0x160 dosyscall_64+0x3b/0x90
The root cause is that erofsworkgroupunfreeze() doesn't reset to orig_val thus it causes a race that the pcluster reuses unexpectedly before freeing.
Since UP platforms are quite rare now, such path becomes unnecessary. Let's drop such specific-designed path directly instead.
[
    {
        "signature_version": "v1",
        "digest": {
            "length": 79.0,
            "function_hash": "159280074823124100250199605149818181004"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-033f12fa",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_workgroup_unfreeze"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94c34faaafe7b55adc2d8d881db195b646959b9e",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 151.0,
            "function_hash": "14463944617410347015492520807033306705"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-09745ea2",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_wait_on_workgroup_freezed"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f44013e39984c127c6efedf70e6b5f4e9dcf315",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 151.0,
            "function_hash": "14463944617410347015492520807033306705"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-10199c09",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_wait_on_workgroup_freezed"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94c34faaafe7b55adc2d8d881db195b646959b9e",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 79.0,
            "function_hash": "159280074823124100250199605149818181004"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-27795f9d",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_workgroup_unfreeze"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ddd001cef5e82d19192e6861068463ecca5f556",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "326747379330887836767328062322635006796",
                "276645137314954093112246409920786025262",
                "206329846853917325269114346972857192204",
                "165106413100808945035958194477152228219",
                "98836550821648773776891632561838317330",
                "223451931009717320193677169541162378792",
                "307018381966546981696484704630865965484",
                "63517158792660180200213206732925762653",
                "108092157164825421045497721400234545311",
                "282831963989324641726079058722223333273",
                "108558123949721394899931473893779984604",
                "161681403957922648505660246231212630799",
                "323904335128552903209653636779693919803",
                "108269268750375110154021367195220657408",
                "105135349804760838859480469610730392589",
                "229691987902295807093865421246285726043",
                "150932428986490194100880678617872599100",
                "328754744066912269473026705363255646103",
                "179212644389637313423333448789395238128",
                "172440009851061794754722021347182727592",
                "231563634557362176262788078910685474815",
                "173736563970429546493158421844812758595",
                "300527093972402318931717611926107137376",
                "232543003105257723125744047084984444796",
                "248437657477336946420177237865448337284",
                "21058658921840011646638692688071358174",
                "32208761216518196954312512994086041946",
                "221534938209502799095047586010807076257",
                "24668710501271984558138678557072111158",
                "805384540691927098205573006016764019"
            ]
        },
        "signature_type": "Line",
        "id": "CVE-2022-48674-3a8b2362",
        "target": {
            "file": "fs/erofs/internal.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94c34faaafe7b55adc2d8d881db195b646959b9e",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 79.0,
            "function_hash": "159280074823124100250199605149818181004"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-45923627",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_workgroup_unfreeze"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f44013e39984c127c6efedf70e6b5f4e9dcf315",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 151.0,
            "function_hash": "14463944617410347015492520807033306705"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-749c356c",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_wait_on_workgroup_freezed"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ddd001cef5e82d19192e6861068463ecca5f556",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "326747379330887836767328062322635006796",
                "276645137314954093112246409920786025262",
                "206329846853917325269114346972857192204",
                "165106413100808945035958194477152228219",
                "98836550821648773776891632561838317330",
                "223451931009717320193677169541162378792",
                "307018381966546981696484704630865965484",
                "63517158792660180200213206732925762653",
                "108092157164825421045497721400234545311",
                "282831963989324641726079058722223333273",
                "108558123949721394899931473893779984604",
                "161681403957922648505660246231212630799",
                "323904335128552903209653636779693919803",
                "108269268750375110154021367195220657408",
                "105135349804760838859480469610730392589",
                "229691987902295807093865421246285726043",
                "150932428986490194100880678617872599100",
                "328754744066912269473026705363255646103",
                "179212644389637313423333448789395238128",
                "172440009851061794754722021347182727592",
                "231563634557362176262788078910685474815",
                "173736563970429546493158421844812758595",
                "300527093972402318931717611926107137376",
                "232543003105257723125744047084984444796",
                "248437657477336946420177237865448337284",
                "21058658921840011646638692688071358174",
                "32208761216518196954312512994086041946",
                "221534938209502799095047586010807076257",
                "24668710501271984558138678557072111158",
                "805384540691927098205573006016764019"
            ]
        },
        "signature_type": "Line",
        "id": "CVE-2022-48674-7e3d0473",
        "target": {
            "file": "fs/erofs/internal.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f44013e39984c127c6efedf70e6b5f4e9dcf315",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 176.0,
            "function_hash": "216074371999307363502255762590443582398"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-7f944f49",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_workgroup_try_to_freeze"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94c34faaafe7b55adc2d8d881db195b646959b9e",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "326747379330887836767328062322635006796",
                "276645137314954093112246409920786025262",
                "206329846853917325269114346972857192204",
                "165106413100808945035958194477152228219",
                "98836550821648773776891632561838317330",
                "223451931009717320193677169541162378792",
                "307018381966546981696484704630865965484",
                "63517158792660180200213206732925762653",
                "108092157164825421045497721400234545311",
                "282831963989324641726079058722223333273",
                "108558123949721394899931473893779984604",
                "161681403957922648505660246231212630799",
                "323904335128552903209653636779693919803",
                "108269268750375110154021367195220657408",
                "105135349804760838859480469610730392589",
                "229691987902295807093865421246285726043",
                "150932428986490194100880678617872599100",
                "328754744066912269473026705363255646103",
                "179212644389637313423333448789395238128",
                "172440009851061794754722021347182727592",
                "231563634557362176262788078910685474815",
                "173736563970429546493158421844812758595",
                "300527093972402318931717611926107137376",
                "232543003105257723125744047084984444796",
                "248437657477336946420177237865448337284",
                "21058658921840011646638692688071358174",
                "32208761216518196954312512994086041946",
                "221534938209502799095047586010807076257",
                "24668710501271984558138678557072111158",
                "805384540691927098205573006016764019"
            ]
        },
        "signature_type": "Line",
        "id": "CVE-2022-48674-809175f9",
        "target": {
            "file": "fs/erofs/internal.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ddd001cef5e82d19192e6861068463ecca5f556",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 176.0,
            "function_hash": "216074371999307363502255762590443582398"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-d53e5d2b",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_workgroup_try_to_freeze"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f44013e39984c127c6efedf70e6b5f4e9dcf315",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 176.0,
            "function_hash": "216074371999307363502255762590443582398"
        },
        "signature_type": "Function",
        "id": "CVE-2022-48674-de2166bc",
        "target": {
            "file": "fs/erofs/internal.h",
            "function": "erofs_workgroup_try_to_freeze"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ddd001cef5e82d19192e6861068463ecca5f556",
        "deprecated": false
    }
]