CVE-2022-50041
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-50041
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50041.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-50041
- Downstream
- Related
- Published
- 2025-06-18T11:01:42Z
- Modified
- 2025-10-21T11:51:53.827292Z
- Summary
- ice: Fix call trace with null VSI during VF reset
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix call trace with null VSI during VF reset
During stress test with attaching and detaching VF from KVM and simultaneously changing VFs spoofcheck and trust there was a call trace in iceresetvf that VF's VSI is null.
[145237.352797] WARNING: CPU: 46 PID: 840629 at drivers/net/ethernet/intel/ice/icevflib.c:508 iceresetvf+0x3d6/0x410 [ice] [145237.352851] Modules linked in: ice(E) vfiopci vfiopcicore vfiovirqfd vfioiommutype1 vfio iavf dmmod xtCHECKSUM xtMASQUERADE xtconntrack iptREJECT nfrejectipv4 nftcompat nftchainnat nfnat nfconntrack nfdefragipv6 nfdefragipv4 nftables nfnetlink tun bridge stp llc sunrpc intelraplmsr intelraplcommon sbedac x86pkgtempthermal intelpowerclamp coretemp kvmintel kvm iTCOwdt iTC Ovendorsupport irqbypass crct10difpclmul crc32pclmul ghashclmulniintel rapl ipmisi intelcstate ipmidevintf joydev inteluncore m eime ipmimsghandler i2ci801 pcspkr mei lpcich ioatdma i2csmbus acpipad acpipowermeter iptables xfs libcrc32c i2calgobit drmsh memhelper drmkmshelper sdmod t10pi crc64rocksoft syscopyarea crc64 sysfillrect sg sysimgblt fbsysfops drm i40e ixgbe ahci libahci libata crc32cintel mdio dca wmi fuse [last unloaded: ice] [145237.352917] CPU: 46 PID: 840629 Comm: kworker/46:2 Tainted: G S W I E 5.19.0-rc6+ #24 [145237.352921] Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0008.021120151325 02/11/2015 [145237.352923] Workqueue: ice iceservicetask [ice] [145237.352948] RIP: 0010:iceresetvf+0x3d6/0x410 [ice] [145237.352984] Code: 30 ec f3 cc e9 28 fd ff ff 0f b7 4b 50 48 c7 c2 48 19 9c c0 4c 89 ee 48 c7 c7 30 fe 9e c0 e8 d1 21 9d cc 31 c0 e9 a 9 fe ff ff <0f> 0b b8 ea ff ff ff e9 c1 fc ff ff 0f 0b b8 fb ff ff ff e9 91 fe [145237.352987] RSP: 0018:ffffb453e257fdb8 EFLAGS: 00010246 [145237.352990] RAX: ffff8bd0040181c0 RBX: ffff8be68db8f800 RCX: 0000000000000000 [145237.352991] RDX: 000000000000ffff RSI: 0000000000000000 RDI: ffff8be68db8f800 [145237.352993] RBP: ffff8bd0040181c0 R08: 0000000000001000 R09: ffff8bcfd520e000 [145237.352995] R10: 0000000000000000 R11: 00008417b5ab0bc0 R12: 0000000000000005 [145237.352996] R13: ffff8bcee061c0d0 R14: ffff8bd004019640 R15: 0000000000000000 [145237.352998] FS: 0000000000000000(0000) GS:ffff8be5dfb00000(0000) knlGS:0000000000000000 [145237.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [145237.353002] CR2: 00007fd81f651d68 CR3: 0000001a0fe10001 CR4: 00000000001726e0 [145237.353003] Call Trace: [145237.353008] <TASK> [145237.353011] iceprocessvflrevent+0x8d/0xb0 [ice] [145237.353049] iceservicetask+0x79f/0xef0 [ice] [145237.353074] processonework+0x1c8/0x390 [145237.353081] ? processonework+0x390/0x390 [145237.353084] workerthread+0x30/0x360 [145237.353087] ? processonework+0x390/0x390 [145237.353090] kthread+0xe8/0x110 [145237.353094] ? kthreadcompleteandexit+0x20/0x20 [145237.353097] retfromfork+0x22/0x30 [145237.353103] </TASK>
Remove WARNON() from check if VSI is null in iceresetvf. Add "VF is already removed\n" in devdbg().
This WARN_ON() is unnecessary and causes call trace, despite that call trace, driver still works. There is no need for this warn because this piece of code is responsible for disabling VF's Tx/Rx queues when VF is disabled, but when VF is already removed there is no need to do reset or disable queues.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedefe41860008e57fb6b69855b4b93fdf34bc42798Fixedaf1b0d1547dd1686ae842cac7f3678649a5cbd89
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedefe41860008e57fb6b69855b4b93fdf34bc42798Fixedcf90b74341eecc32ceef0c136954a1668e43b1e7
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected1bb8253b1dd44cf004e12c333acc6f25ee286cf3
Affected versions
v2.*
v3.*
v4.*
v5.*
Database specific
vanir_signatures
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf90b74341eecc32ceef0c136954a1668e43b1e7",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ice_reset_vf",
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
},
"id": "CVE-2022-50041-4de7f8a1",
"digest": {
"length": 2187.0,
"function_hash": "199962634678878459724607228016902270354"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af1b0d1547dd1686ae842cac7f3678649a5cbd89",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ice_reset_vf",
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
},
"id": "CVE-2022-50041-71ae8cd0",
"digest": {
"length": 2516.0,
"function_hash": "210369640512457419152632408754453520909"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf90b74341eecc32ceef0c136954a1668e43b1e7",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
},
"id": "CVE-2022-50041-ee271ac5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43197533741748481115968576173870623630",
"253710368910709780394742240332141114993",
"101474208540648639203447064572202464248",
"155879379964512917034929238299195202850",
"34853791844078303210430605261432655716"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af1b0d1547dd1686ae842cac7f3678649a5cbd89",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
},
"id": "CVE-2022-50041-ff1cdcf9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43197533741748481115968576173870623630",
"253710368910709780394742240332141114993",
"101474208540648639203447064572202464248",
"155879379964512917034929238299195202850",
"34853791844078303210430605261432655716"
]
},
"signature_type": "Line"
}
]