In the Linux kernel, the following vulnerability has been resolved:
ice: fix concurrent reset and removal of VFs
Commit c503e63200c6 ("ice: Stop processing VF messages during teardown") introduced a driver state flag, ICEVFDEINITINPROGRESS, which is intended to prevent some issues with concurrently handling messages from VFs while tearing down the VFs.
This change was motivated by crashes caused while tearing down and bringing up VFs in rapid succession.
It turns out that the fix actually introduces issues with the VF driver caused because the PF no longer responds to any messages sent by the VF during its .remove routine. This results in the VF potentially removing its DMA memory before the PF has shut down the device queues.
Additionally, the fix doesn't actually resolve concurrency issues within the ice driver. It is possible for a VF to initiate a reset just prior to the ice driver removing VFs. This can result in the remove task concurrently operating while the VF is being reset. This results in similar memory corruption and panics purportedly fixed by that commit.
Fix this concurrency at its root by protecting both the reset and removal flows using the existing VF cfg_lock. This ensures that we cannot remove the VF while any outstanding critical tasks such as a virtchnl message or a reset are occurring.
This locking change also fixes the root cause originally fixed by commit c503e63200c6 ("ice: Stop processing VF messages during teardown"), so we can simply revert it.
Note that I kept these two changes together because simply reverting the original commit alone would leave the driver vulnerable to worse race conditions.
[
{
"id": "CVE-2022-48941-013ca7fa",
"signature_version": "v1",
"digest": {
"length": 1367.0,
"function_hash": "174431375956625328650624858576726658738"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_reset_all_vfs"
}
},
{
"id": "CVE-2022-48941-0281519c",
"signature_version": "v1",
"digest": {
"length": 4206.0,
"function_hash": "251125208675861953708705999886819467430"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_main.c",
"function": "ice_handle_mdd_event"
}
},
{
"id": "CVE-2022-48941-08331e77",
"signature_version": "v1",
"digest": {
"length": 4206.0,
"function_hash": "251125208675861953708705999886819467430"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_main.c",
"function": "ice_handle_mdd_event"
}
},
{
"id": "CVE-2022-48941-09709495",
"signature_version": "v1",
"digest": {
"length": 498.0,
"function_hash": "95479920564085753285767968455068084393"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_process_vflr_event"
}
},
{
"id": "CVE-2022-48941-0bc702f7",
"signature_version": "v1",
"digest": {
"length": 382.0,
"function_hash": "264046358900354594992709274611558721328"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_vf_lan_overflow_event"
}
},
{
"id": "CVE-2022-48941-0c7cc5b7",
"signature_version": "v1",
"digest": {
"length": 498.0,
"function_hash": "95479920564085753285767968455068084393"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_process_vflr_event"
}
},
{
"id": "CVE-2022-48941-14393247",
"signature_version": "v1",
"digest": {
"length": 498.0,
"function_hash": "95479920564085753285767968455068084393"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_process_vflr_event"
}
},
{
"id": "CVE-2022-48941-490c351a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"297973391512446821684095073857883649639",
"279741030714184488039524244439251005685",
"206644696177612462186542982132568598120",
"201294841344692728662684891608264826695",
"88682694997381565705469727838969706171"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
}
},
{
"id": "CVE-2022-48941-4a46b47b",
"signature_version": "v1",
"digest": {
"length": 1994.0,
"function_hash": "250665960841900786865923427764363519792"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_reset_vf"
}
},
{
"id": "CVE-2022-48941-55d91e55",
"signature_version": "v1",
"digest": {
"length": 1677.0,
"function_hash": "290229456431613343693183011113981112421"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_free_vfs"
}
},
{
"id": "CVE-2022-48941-60887614",
"signature_version": "v1",
"digest": {
"length": 1698.0,
"function_hash": "316338948563702369333297742444074925505"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_free_vfs"
}
},
{
"id": "CVE-2022-48941-60cffd47",
"signature_version": "v1",
"digest": {
"length": 4206.0,
"function_hash": "251125208675861953708705999886819467430"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_main.c",
"function": "ice_handle_mdd_event"
}
},
{
"id": "CVE-2022-48941-6dba7b8c",
"signature_version": "v1",
"digest": {
"length": 382.0,
"function_hash": "264046358900354594992709274611558721328"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_vf_lan_overflow_event"
}
},
{
"id": "CVE-2022-48941-7e055564",
"signature_version": "v1",
"digest": {
"length": 382.0,
"function_hash": "264046358900354594992709274611558721328"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_vf_lan_overflow_event"
}
},
{
"id": "CVE-2022-48941-8ada524b",
"signature_version": "v1",
"digest": {
"length": 2029.0,
"function_hash": "133509601088590542944761919669851640687"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_reset_vf"
}
},
{
"id": "CVE-2022-48941-8b34501f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171724445314667359168315492759403668466",
"211909282627295210386707080738815622466",
"88944152510616944356543122484220781724",
"136235385630730220363568571838488942079"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice.h"
}
},
{
"id": "CVE-2022-48941-8d21c76f",
"signature_version": "v1",
"digest": {
"length": 1267.0,
"function_hash": "325137458209454778740755826861976282334"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_reset_all_vfs"
}
},
{
"id": "CVE-2022-48941-8d78edf6",
"signature_version": "v1",
"digest": {
"length": 3671.0,
"function_hash": "1320213962872211627695306779773572954"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_vc_process_vf_msg"
}
},
{
"id": "CVE-2022-48941-8f0354f5",
"signature_version": "v1",
"digest": {
"length": 1698.0,
"function_hash": "316338948563702369333297742444074925505"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_free_vfs"
}
},
{
"id": "CVE-2022-48941-a0fea926",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114257732298104465380786409706391402505",
"16418329118019765550314461288607343745",
"153488540220351517980715226297802894068",
"57545552436877895112271503723697585396",
"133595961079171242187455314198458331865",
"264504163575018225774645894619957590381",
"119912084628565264002023585211896338848",
"314897571704844823291166527971892380055",
"246546385717593305024973735903219254055",
"101741693109293452883908662592089100078",
"136371583952017861737141420507278899959",
"93964143896251277767964141640121106899",
"281237515452976104348605495346676895396",
"204193746499654905157589326795066007658",
"260143532079536070789952816297626055531",
"255490195846529834159441875455492270039",
"8343861839276003592854345044947252726",
"176130116183710034378223231060498532824",
"269069515297643216515964115306574701724",
"69803010566780911838872632762615955071",
"24247437279379475469646923142865173226",
"265309301795781276548955491470657857783",
"24356724516142346603604479318459562310",
"151053674733205232644818112299573784486",
"263415785789342126551056364212764205395",
"50077289611448858107215381335192635318",
"38365450460111393614489726270268023719",
"16751472314445251959843190909044243117",
"135666506473509809094327350378158555675",
"226591304405545071060517353880252840443",
"87201032270537250539745441056008575236",
"56841287337406311074532035286173149677",
"299958397048767102836088740698874455922",
"157686918816854449102528336293729258971",
"89286650306424128371424385321273903265",
"308525500860582839674656083094133299425",
"125758117572468834869436303992910865658",
"29556979109184436364264730812016403653",
"201557358821379428671481148689943611668",
"269155870293745226659206547162047326927",
"41408191453770275727077710496472898485",
"194671249648308891468733551013972950488",
"97529837343020497006299438538591285278",
"65575620776995880367325364921316549784",
"274448003956253862431217076370826439638",
"240949050909273358240736759580485799067",
"114422963336380470083753775632862660663"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"
}
},
{
"id": "CVE-2022-48941-a122c5d6",
"signature_version": "v1",
"digest": {
"length": 3671.0,
"function_hash": "1320213962872211627695306779773572954"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_vc_process_vf_msg"
}
},
{
"id": "CVE-2022-48941-a632896f",
"signature_version": "v1",
"digest": {
"length": 3333.0,
"function_hash": "330034546403489919328856063946369275302"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_vc_process_vf_msg"
}
},
{
"id": "CVE-2022-48941-ab72ec9f",
"signature_version": "v1",
"digest": {
"length": 1367.0,
"function_hash": "174431375956625328650624858576726658738"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_reset_all_vfs"
}
},
{
"id": "CVE-2022-48941-bd09562d",
"signature_version": "v1",
"digest": {
"length": 1948.0,
"function_hash": "62214224980331092528354490547871969167"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c",
"function": "ice_reset_vf"
}
},
{
"id": "CVE-2022-48941-d3efe89c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171724445314667359168315492759403668466",
"211909282627295210386707080738815622466",
"88944152510616944356543122484220781724",
"136235385630730220363568571838488942079"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice.h"
}
},
{
"id": "CVE-2022-48941-df9290fe",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114257732298104465380786409706391402505",
"16418329118019765550314461288607343745",
"153488540220351517980715226297802894068",
"213070464058190012554948192866424731720",
"133595961079171242187455314198458331865",
"264504163575018225774645894619957590381",
"119912084628565264002023585211896338848",
"314897571704844823291166527971892380055",
"246546385717593305024973735903219254055",
"101741693109293452883908662592089100078",
"136371583952017861737141420507278899959",
"93964143896251277767964141640121106899",
"281237515452976104348605495346676895396",
"204193746499654905157589326795066007658",
"260143532079536070789952816297626055531",
"255490195846529834159441875455492270039",
"8343861839276003592854345044947252726",
"176130116183710034378223231060498532824",
"269069515297643216515964115306574701724",
"69803010566780911838872632762615955071",
"24247437279379475469646923142865173226",
"265309301795781276548955491470657857783",
"24356724516142346603604479318459562310",
"151053674733205232644818112299573784486",
"263415785789342126551056364212764205395",
"50077289611448858107215381335192635318",
"38365450460111393614489726270268023719",
"16751472314445251959843190909044243117",
"52727290103933719987602819699518175763",
"30742408385408607662336605098054623114",
"87201032270537250539745441056008575236",
"56841287337406311074532035286173149677",
"299958397048767102836088740698874455922",
"157686918816854449102528336293729258971",
"89286650306424128371424385321273903265",
"308525500860582839674656083094133299425",
"125758117572468834869436303992910865658",
"29556979109184436364264730812016403653",
"201557358821379428671481148689943611668",
"269155870293745226659206547162047326927",
"41408191453770275727077710496472898485",
"194671249648308891468733551013972950488",
"97529837343020497006299438538591285278",
"65575620776995880367325364921316549784",
"274448003956253862431217076370826439638",
"240949050909273358240736759580485799067",
"114422963336380470083753775632862660663"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"
}
},
{
"id": "CVE-2022-48941-dfac0d90",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114257732298104465380786409706391402505",
"16418329118019765550314461288607343745",
"153488540220351517980715226297802894068",
"57545552436877895112271503723697585396",
"133595961079171242187455314198458331865",
"264504163575018225774645894619957590381",
"119912084628565264002023585211896338848",
"314897571704844823291166527971892380055",
"246546385717593305024973735903219254055",
"101741693109293452883908662592089100078",
"136371583952017861737141420507278899959",
"93964143896251277767964141640121106899",
"281237515452976104348605495346676895396",
"204193746499654905157589326795066007658",
"260143532079536070789952816297626055531",
"255490195846529834159441875455492270039",
"8343861839276003592854345044947252726",
"176130116183710034378223231060498532824",
"269069515297643216515964115306574701724",
"69803010566780911838872632762615955071",
"24247437279379475469646923142865173226",
"265309301795781276548955491470657857783",
"24356724516142346603604479318459562310",
"151053674733205232644818112299573784486",
"263415785789342126551056364212764205395",
"50077289611448858107215381335192635318",
"38365450460111393614489726270268023719",
"16751472314445251959843190909044243117",
"135666506473509809094327350378158555675",
"226591304405545071060517353880252840443",
"87201032270537250539745441056008575236",
"56841287337406311074532035286173149677",
"299958397048767102836088740698874455922",
"157686918816854449102528336293729258971",
"89286650306424128371424385321273903265",
"308525500860582839674656083094133299425",
"125758117572468834869436303992910865658",
"29556979109184436364264730812016403653",
"201557358821379428671481148689943611668",
"269155870293745226659206547162047326927",
"41408191453770275727077710496472898485",
"194671249648308891468733551013972950488",
"97529837343020497006299438538591285278",
"65575620776995880367325364921316549784",
"274448003956253862431217076370826439638",
"240949050909273358240736759580485799067",
"114422963336380470083753775632862660663"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"
}
},
{
"id": "CVE-2022-48941-f46fe9f8",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171724445314667359168315492759403668466",
"211909282627295210386707080738815622466",
"88944152510616944356543122484220781724",
"136235385630730220363568571838488942079"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a3e61de89bab6696aa28b70030eb119968c5586",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice.h"
}
},
{
"id": "CVE-2022-48941-f5e7387f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"297973391512446821684095073857883649639",
"279741030714184488039524244439251005685",
"206644696177612462186542982132568598120",
"201294841344692728662684891608264826695",
"88682694997381565705469727838969706171"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadead80fe4c033b5e514fcbadd20b55c4494112",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
}
},
{
"id": "CVE-2022-48941-fb55789b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"297973391512446821684095073857883649639",
"279741030714184488039524244439251005685",
"206644696177612462186542982132568598120",
"201294841344692728662684891608264826695",
"88682694997381565705469727838969706171"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c805fce07c9dbc47d8a9129c7c5458025951957",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_main.c"
}
}
]