In the Linux kernel, the following vulnerability has been resolved:
sfc: fix kernel panic when creating VF
When creating VFs a kernel panic can happen when calling to efxef10tryupdatenicstatsvf.
When releasing a DMA coherent buffer, sometimes, I don't know in what specific circumstances, it has to unmap memory with vunmap. It is disallowed to do that in IRQ context or with BH disabled. Otherwise, we hit this line in vunmap, causing the crash: BUGON(ininterrupt());
This patch reenables BH to release the buffer.
Log messages when the bug is hit: kernel BUG at mm/vmalloc.c:2727! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x8664 #1 Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 RIP: 0010:vunmap+0x2e/0x30 ...skip... Call Trace: _iommudmafree+0x96/0x100 efxnicfreebuffer+0x2b/0x40 [sfc] efxef10tryupdatenicstatsvf+0x14a/0x1c0 [sfc] efxef10updatestatsvf+0x18/0x40 [sfc] efxstartall+0x15e/0x1d0 [sfc] efxnetopen+0x5a/0xe0 [sfc] _devopen+0xe7/0x1a0 _devchangeflags+0x1d7/0x240 devchangeflags+0x21/0x60 ...skip...
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9072305270579a9d6afc9b926166231e5b1a7c8",
"id": "CVE-2022-49625-0225f4aa",
"deprecated": false,
"target": {
"function": "efx_ef10_try_update_nic_stats_vf",
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1604.0,
"function_hash": "146460089887901286489368544108181740217"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9840212a9c00507347c703f4fdeda16400407e0",
"id": "CVE-2022-49625-073e9ff7",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294716029952468656485995694069222639408",
"44155541015748502999524420812753650762",
"85007347585708725557825033471112741914",
"279369378723359122106983074577991263818",
"40528786138678816487883027229071400693"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9072305270579a9d6afc9b926166231e5b1a7c8",
"id": "CVE-2022-49625-14fa7e93",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294716029952468656485995694069222639408",
"44155541015748502999524420812753650762",
"85007347585708725557825033471112741914",
"279369378723359122106983074577991263818",
"40528786138678816487883027229071400693"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9840212a9c00507347c703f4fdeda16400407e0",
"id": "CVE-2022-49625-28167931",
"deprecated": false,
"target": {
"function": "efx_ef10_try_update_nic_stats_vf",
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1604.0,
"function_hash": "146460089887901286489368544108181740217"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ada74c5539eba06cf8b47d068f92e0b3963a9a6e",
"id": "CVE-2022-49625-822ec82c",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294716029952468656485995694069222639408",
"44155541015748502999524420812753650762",
"85007347585708725557825033471112741914",
"279369378723359122106983074577991263818",
"40528786138678816487883027229071400693"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82bcb730f856086f033e6c04082eb4503d4c2fa4",
"id": "CVE-2022-49625-842cd70a",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294716029952468656485995694069222639408",
"44155541015748502999524420812753650762",
"85007347585708725557825033471112741914",
"279369378723359122106983074577991263818",
"40528786138678816487883027229071400693"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16662524ec5da801fb78a1afcaf6e782f1cf103a",
"id": "CVE-2022-49625-8b3b0966",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294716029952468656485995694069222639408",
"44155541015748502999524420812753650762",
"85007347585708725557825033471112741914",
"279369378723359122106983074577991263818",
"40528786138678816487883027229071400693"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da346adcf5573fd8663cabfdfe8371009629a906",
"id": "CVE-2022-49625-9558ea28",
"deprecated": false,
"target": {
"function": "efx_ef10_try_update_nic_stats_vf",
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1611.0,
"function_hash": "145494015011191236265651074430641933778"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e5f32f0de9594629ff9e599294d9801c6187de",
"id": "CVE-2022-49625-98b0e506",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294716029952468656485995694069222639408",
"44155541015748502999524420812753650762",
"85007347585708725557825033471112741914",
"279369378723359122106983074577991263818",
"40528786138678816487883027229071400693"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b82e4ad58a7fb72456503958a93060f87896e629",
"id": "CVE-2022-49625-cc417254",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294716029952468656485995694069222639408",
"44155541015748502999524420812753650762",
"85007347585708725557825033471112741914",
"279369378723359122106983074577991263818",
"40528786138678816487883027229071400693"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82bcb730f856086f033e6c04082eb4503d4c2fa4",
"id": "CVE-2022-49625-ec05dd95",
"deprecated": false,
"target": {
"function": "efx_ef10_try_update_nic_stats_vf",
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1611.0,
"function_hash": "145494015011191236265651074430641933778"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da346adcf5573fd8663cabfdfe8371009629a906",
"id": "CVE-2022-49625-ec21791d",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/sfc/ef10.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294716029952468656485995694069222639408",
"44155541015748502999524420812753650762",
"85007347585708725557825033471112741914",
"279369378723359122106983074577991263818",
"40528786138678816487883027229071400693"
]
}
}
]