In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: treat all calls not a bcall when bc_serv is NULL
When a rdma server returns a fault format reply, nfs v3 client may treats it as a bcall when bc service is not exist.
The debug message at rpcrdmabcreceive_call are,
[56579.837169] RPC: rpcrdmabcreceivecall: callback XID 00000001, length=20 [56579.837174] RPC: rpcrdmabcreceivecall: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
After that, rpcrdmabcreceive_call will meets NULL pointer as,
[ 226.057890] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8 ... [ 226.058704] RIP: 0010:rawspinlock+0xc/0x20 ... [ 226.059732] Call Trace: [ 226.059878] rpcrdmabcreceivecall+0x138/0x327 [rpcrdma] [ 226.060011] _ibprocesscq+0x89/0x170 [ibcore] [ 226.060092] ibcqpollwork+0x26/0x80 [ibcore] [ 226.060257] processonework+0x1a7/0x360 [ 226.060367] ? createworker+0x1a0/0x1a0 [ 226.060440] workerthread+0x30/0x390 [ 226.060500] ? createworker+0x1a0/0x1a0 [ 226.060574] kthread+0x116/0x130 [ 226.060661] ? kthreadflushworkfn+0x10/0x10 [ 226.060724] retfromfork+0x35/0x40 ...
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e3943c50764dc7c5f25911970c3ff062ec1f18c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"55346268080868259504734939405021846639",
"235105349311875728773194419620940888380",
"303889303000489062525978405497340460555",
"209463877896798219776468423800615325809",
"32228412859289358672474706323595978598",
"307826712361324110665608579716377196037",
"203872482140021524890599296926726350402"
]
},
"target": {
"file": "net/sunrpc/xprtrdma/rpc_rdma.c"
},
"id": "CVE-2022-49321-29f482b2",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91784f3d77b73885e1b2e6b59d3cbf0de0a1126a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235029379186039897431408958888508417838",
"89821010974822781882566892415365028864",
"303889303000489062525978405497340460555",
"23537407269699739452794242340332595101",
"32228412859289358672474706323595978598",
"307826712361324110665608579716377196037",
"312559221933209369583205543158574333591"
]
},
"target": {
"file": "net/sunrpc/xprtrdma/rpc_rdma.c"
},
"id": "CVE-2022-49321-4556324d",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@998d35a2aff4b81a1c784f3aa45cd3afff6814c1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235029379186039897431408958888508417838",
"89821010974822781882566892415365028864",
"303889303000489062525978405497340460555",
"23537407269699739452794242340332595101",
"32228412859289358672474706323595978598",
"307826712361324110665608579716377196037",
"203872482140021524890599296926726350402"
]
},
"target": {
"file": "net/sunrpc/xprtrdma/rpc_rdma.c"
},
"id": "CVE-2022-49321-469145b0",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90c4f73104016748533a5707ecd15930fbeff402",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235029379186039897431408958888508417838",
"89821010974822781882566892415365028864",
"303889303000489062525978405497340460555",
"23537407269699739452794242340332595101",
"32228412859289358672474706323595978598",
"307826712361324110665608579716377196037",
"312559221933209369583205543158574333591"
]
},
"target": {
"file": "net/sunrpc/xprtrdma/rpc_rdma.c"
},
"id": "CVE-2022-49321-4e8024a3",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11270e7ca268e8d61b5d9e5c3a54bd1550642c9c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235029379186039897431408958888508417838",
"89821010974822781882566892415365028864",
"303889303000489062525978405497340460555",
"23537407269699739452794242340332595101",
"32228412859289358672474706323595978598",
"307826712361324110665608579716377196037",
"312559221933209369583205543158574333591"
]
},
"target": {
"file": "net/sunrpc/xprtrdma/rpc_rdma.c"
},
"id": "CVE-2022-49321-c92715f8",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da99331fa62131a38a0947a8204c5208de7b0454",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235029379186039897431408958888508417838",
"89821010974822781882566892415365028864",
"303889303000489062525978405497340460555",
"23537407269699739452794242340332595101",
"32228412859289358672474706323595978598",
"307826712361324110665608579716377196037",
"203872482140021524890599296926726350402"
]
},
"target": {
"file": "net/sunrpc/xprtrdma/rpc_rdma.c"
},
"id": "CVE-2022-49321-d1fbfdc1",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8dbae5affbdbf524b48000f9d357925bb001e5f4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235029379186039897431408958888508417838",
"89821010974822781882566892415365028864",
"303889303000489062525978405497340460555",
"23537407269699739452794242340332595101",
"32228412859289358672474706323595978598",
"307826712361324110665608579716377196037",
"203872482140021524890599296926726350402"
]
},
"target": {
"file": "net/sunrpc/xprtrdma/rpc_rdma.c"
},
"id": "CVE-2022-49321-d62b8797",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3fc8051ee061e31db13e2fe011e8e0b71a7f815",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235029379186039897431408958888508417838",
"89821010974822781882566892415365028864",
"303889303000489062525978405497340460555",
"23537407269699739452794242340332595101",
"32228412859289358672474706323595978598",
"307826712361324110665608579716377196037",
"312559221933209369583205543158574333591"
]
},
"target": {
"file": "net/sunrpc/xprtrdma/rpc_rdma.c"
},
"id": "CVE-2022-49321-eaf504aa",
"signature_version": "v1",
"signature_type": "Line"
}
]