In the Linux kernel, the following vulnerability has been resolved:
sfc: fix use after free when disabling sriov
Use after free is detected by kfence when disabling sriov. What was read after being freed was vf->pcidev: it was freed from pcidisablesriov and later read in efxef10sriovfreevfvports, called from efxef10sriovfreevf_vswitching.
Set the pointer to NULL at release time to not trying to read it later.
Reproducer and dmesg log (note that kfence doesn't detect it every time): $ echo 1 > /sys/class/net/enp65s0f0np0/device/sriovnumvfs $ echo 0 > /sys/class/net/enp65s0f0np0/device/sriovnumvfs
BUG: KFENCE: use-after-free read in efxef10sriovfreevf_vswitching+0x82/0x170 [sfc]
Use-after-free read at 0x00000000ff3c1ba5 (in kfence-#224): efxef10sriovfreevfvswitching+0x82/0x170 [sfc] efxef10pcisriovdisable+0x38/0x70 [sfc] efxpcisriovconfigure+0x24/0x40 [sfc] sriovnumvfsstore+0xfe/0x140 kernfsfopwriteiter+0x11c/0x1b0 newsyncwrite+0x11f/0x1b0 vfswrite+0x1eb/0x280 ksyswrite+0x5f/0xe0 dosyscall64+0x5c/0x80 entrySYSCALL64after_hwframe+0x44/0xae
kfence-#224: 0x00000000edb8ef95-0x00000000671f5ce1, size=2792, cache=kmalloc-4k
allocated by task 6771 on cpu 10 at 3137.860196s: pciallocdev+0x21/0x60 pciiovaddvirtfn+0x2a2/0x320 sriovenable+0x212/0x3e0 efxef10sriovconfigure+0x67/0x80 [sfc] efxpcisriovconfigure+0x24/0x40 [sfc] sriovnumvfsstore+0xba/0x140 kernfsfopwriteiter+0x11c/0x1b0 newsyncwrite+0x11f/0x1b0 vfswrite+0x1eb/0x280 ksyswrite+0x5f/0xe0 dosyscall64+0x5c/0x80 entrySYSCALL64after_hwframe+0x44/0xae
freed by task 6771 on cpu 12 at 3170.991309s: devicerelease+0x34/0x90 kobjectcleanup+0x3a/0x130 pciiovremovevirtfn+0xd9/0x120 sriovdisable+0x30/0xe0 efxef10pcisriovdisable+0x57/0x70 [sfc] efxpcisriovconfigure+0x24/0x40 [sfc] sriovnumvfsstore+0xfe/0x140 kernfsfopwriteiter+0x11c/0x1b0 newsyncwrite+0x11f/0x1b0 vfswrite+0x1eb/0x280 ksyswrite+0x5f/0xe0 dosyscall64+0x5c/0x80 entrySYSCALL64afterhwframe+0x44/0xae
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2240500817b3b4b996cdf2a461a3a5679f49b94",
"target": {
"function": "efx_ef10_pci_sriov_disable",
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-000dc32d",
"digest": {
"length": 432.0,
"function_hash": "176232544185356799833532508770944182129"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c854ae512b89229aeee93849e9bd4c115b37909",
"target": {
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-0b265615",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265076037167781263239382634248240977065",
"84711201914881479397772871869313017217",
"7535730861982800706837172781858428960",
"3702775593183768114693623253881492645",
"157503540689896248288765385902990560220",
"262481948660146490523797732550683156564",
"40791551118120917660989160468798693203",
"144118521016275351973646145084695194615",
"47262137903955391583371125511072336021",
"88004707921746290294490063474126169734",
"67607268002143473370179616977966048852",
"309201114515445458363110610740051326556",
"300658870122582316719436190144239438438"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9e75bb22a26e391f189f5a5133dd63dcb57fdaa",
"target": {
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-10d69265",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265076037167781263239382634248240977065",
"84711201914881479397772871869313017217",
"7535730861982800706837172781858428960",
"3702775593183768114693623253881492645",
"157503540689896248288765385902990560220",
"262481948660146490523797732550683156564",
"40791551118120917660989160468798693203",
"144118521016275351973646145084695194615",
"47262137903955391583371125511072336021",
"88004707921746290294490063474126169734",
"67607268002143473370179616977966048852",
"309201114515445458363110610740051326556",
"300658870122582316719436190144239438438"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c854ae512b89229aeee93849e9bd4c115b37909",
"target": {
"function": "efx_ef10_pci_sriov_disable",
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-2254cd5d",
"digest": {
"length": 432.0,
"function_hash": "176232544185356799833532508770944182129"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9e75bb22a26e391f189f5a5133dd63dcb57fdaa",
"target": {
"function": "efx_ef10_pci_sriov_disable",
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-2e590587",
"digest": {
"length": 432.0,
"function_hash": "176232544185356799833532508770944182129"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e435c4aeeaa073091f7f3b7735af2ef5c97d63f2",
"target": {
"function": "efx_ef10_pci_sriov_disable",
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-368e1440",
"digest": {
"length": 432.0,
"function_hash": "176232544185356799833532508770944182129"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58d93e9d160c0de6d867c7eb4c2206671a351eb1",
"target": {
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-3f0fc741",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265076037167781263239382634248240977065",
"84711201914881479397772871869313017217",
"7535730861982800706837172781858428960",
"3702775593183768114693623253881492645",
"157503540689896248288765385902990560220",
"262481948660146490523797732550683156564",
"40791551118120917660989160468798693203",
"144118521016275351973646145084695194615",
"47262137903955391583371125511072336021",
"88004707921746290294490063474126169734",
"67607268002143473370179616977966048852",
"309201114515445458363110610740051326556",
"300658870122582316719436190144239438438"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebe41da5d47ac0fff877e57bd14c54dccf168827",
"target": {
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-4533110a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265076037167781263239382634248240977065",
"84711201914881479397772871869313017217",
"7535730861982800706837172781858428960",
"3702775593183768114693623253881492645",
"157503540689896248288765385902990560220",
"262481948660146490523797732550683156564",
"40791551118120917660989160468798693203",
"144118521016275351973646145084695194615",
"47262137903955391583371125511072336021",
"88004707921746290294490063474126169734",
"67607268002143473370179616977966048852",
"309201114515445458363110610740051326556",
"300658870122582316719436190144239438438"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3199e34912d84cdfb8a93a984c5ae5c73fb13e84",
"target": {
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-5a8d3cbc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265076037167781263239382634248240977065",
"84711201914881479397772871869313017217",
"7535730861982800706837172781858428960",
"3702775593183768114693623253881492645",
"157503540689896248288765385902990560220",
"262481948660146490523797732550683156564",
"40791551118120917660989160468798693203",
"144118521016275351973646145084695194615",
"47262137903955391583371125511072336021",
"88004707921746290294490063474126169734",
"67607268002143473370179616977966048852",
"309201114515445458363110610740051326556",
"300658870122582316719436190144239438438"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3199e34912d84cdfb8a93a984c5ae5c73fb13e84",
"target": {
"function": "efx_ef10_pci_sriov_disable",
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-66fca244",
"digest": {
"length": 432.0,
"function_hash": "176232544185356799833532508770944182129"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcad880865bfb421885364b1f0c7351280fe2b97",
"target": {
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-72e24659",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265076037167781263239382634248240977065",
"84711201914881479397772871869313017217",
"7535730861982800706837172781858428960",
"3702775593183768114693623253881492645",
"157503540689896248288765385902990560220",
"262481948660146490523797732550683156564",
"40791551118120917660989160468798693203",
"144118521016275351973646145084695194615",
"47262137903955391583371125511072336021",
"88004707921746290294490063474126169734",
"67607268002143473370179616977966048852",
"309201114515445458363110610740051326556",
"300658870122582316719436190144239438438"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58d93e9d160c0de6d867c7eb4c2206671a351eb1",
"target": {
"function": "efx_ef10_pci_sriov_disable",
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-888beb5f",
"digest": {
"length": 432.0,
"function_hash": "176232544185356799833532508770944182129"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2240500817b3b4b996cdf2a461a3a5679f49b94",
"target": {
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-9b2dd1f3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265076037167781263239382634248240977065",
"84711201914881479397772871869313017217",
"7535730861982800706837172781858428960",
"3702775593183768114693623253881492645",
"157503540689896248288765385902990560220",
"262481948660146490523797732550683156564",
"40791551118120917660989160468798693203",
"144118521016275351973646145084695194615",
"47262137903955391583371125511072336021",
"88004707921746290294490063474126169734",
"67607268002143473370179616977966048852",
"309201114515445458363110610740051326556",
"300658870122582316719436190144239438438"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcad880865bfb421885364b1f0c7351280fe2b97",
"target": {
"function": "efx_ef10_pci_sriov_disable",
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-b91cc713",
"digest": {
"length": 432.0,
"function_hash": "176232544185356799833532508770944182129"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebe41da5d47ac0fff877e57bd14c54dccf168827",
"target": {
"function": "efx_ef10_pci_sriov_disable",
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-e8e9dbde",
"digest": {
"length": 432.0,
"function_hash": "176232544185356799833532508770944182129"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e435c4aeeaa073091f7f3b7735af2ef5c97d63f2",
"target": {
"file": "drivers/net/ethernet/sfc/ef10_sriov.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49626-f546ba22",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265076037167781263239382634248240977065",
"84711201914881479397772871869313017217",
"7535730861982800706837172781858428960",
"3702775593183768114693623253881492645",
"157503540689896248288765385902990560220",
"262481948660146490523797732550683156564",
"40791551118120917660989160468798693203",
"144118521016275351973646145084695194615",
"47262137903955391583371125511072336021",
"88004707921746290294490063474126169734",
"67607268002143473370179616977966048852",
"309201114515445458363110610740051326556",
"300658870122582316719436190144239438438"
]
},
"signature_type": "Line"
}
]