In the Linux kernel, the following vulnerability has been resolved:
net: sched: cake: fix null pointer access issue when cake_init() fails
When the default qdisc is cake, if the qdisc of devqueue fails to be inited during mqprioinit(), cake_reset() is invoked to clear resources. In this case, the tins is NULL, and it will cause gpf issue.
The process is as follows: qdisccreatedflt() cakeinit() q->tins = kvcalloc(...) --->failed, q->tins is NULL ... qdiscput() ... cakereset() ... cakedequeue_one() b = &q->tins[...] --->q->tins is NULL
The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:cakedequeueone+0xc9/0x3c0 Call Trace: <TASK> cakereset+0xb1/0x140 qdiscreset+0xed/0x6f0 qdiscdestroy+0x82/0x4c0 qdiscput+0x9e/0xb0 qdisccreatedflt+0x2c3/0x4a0 mqprioinit+0xa71/0x1760 qdisccreate+0x3eb/0x1000 tcmodifyqdisc+0x408/0x1720 rtnetlinkrcvmsg+0x38e/0xac0 netlinkrcvskb+0x12d/0x3a0 netlinkunicast+0x4a2/0x740 netlinksendmsg+0x826/0xcc0 socksendmsg+0xc5/0x100 syssendmsg+0x583/0x690 syssendmsg+0xe8/0x160 _syssendmsg+0xbf/0x160 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0 RIP: 0033:0x7f89e5122d04 </TASK>
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25087212304424645005304787980364630190",
"184555795574186087419558859431104000587",
"176802997700730710890318700899418080898",
"217761325529572131324103145559538025017",
"127597309823861468951355853432182083559"
]
},
"deprecated": false,
"id": "CVE-2022-50452-1fa62fb8",
"target": {
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae48bee2830bf216800e1447baca39541e27a12e",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "277379765150868468096432641722875092905",
"length": 129.0
},
"deprecated": false,
"id": "CVE-2022-50452-275b8933",
"target": {
"function": "cake_reset",
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86aa1390898146f1de277bb6d2a8ed7fc7a43f12",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "277379765150868468096432641722875092905",
"length": 129.0
},
"deprecated": false,
"id": "CVE-2022-50452-35df2429",
"target": {
"function": "cake_reset",
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc8301ea7e7f1bb9d2ba2fcdf7b5ec2f0792b47e",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "277379765150868468096432641722875092905",
"length": 129.0
},
"deprecated": false,
"id": "CVE-2022-50452-363fb399",
"target": {
"function": "cake_reset",
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@154f4c06d9dbec1a14e91286c70b6305810302e0",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25087212304424645005304787980364630190",
"184555795574186087419558859431104000587",
"176802997700730710890318700899418080898",
"217761325529572131324103145559538025017",
"127597309823861468951355853432182083559"
]
},
"deprecated": false,
"id": "CVE-2022-50452-4a1894c5",
"target": {
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86aa1390898146f1de277bb6d2a8ed7fc7a43f12",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "277379765150868468096432641722875092905",
"length": 129.0
},
"deprecated": false,
"id": "CVE-2022-50452-6aef418a",
"target": {
"function": "cake_reset",
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "277379765150868468096432641722875092905",
"length": 129.0
},
"deprecated": false,
"id": "CVE-2022-50452-85758326",
"target": {
"function": "cake_reset",
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae48bee2830bf216800e1447baca39541e27a12e",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25087212304424645005304787980364630190",
"184555795574186087419558859431104000587",
"176802997700730710890318700899418080898",
"217761325529572131324103145559538025017",
"127597309823861468951355853432182083559"
]
},
"deprecated": false,
"id": "CVE-2022-50452-8f4d533d",
"target": {
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1dc0a019550fd38ec6cab2d73c90df2bd659c96b",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25087212304424645005304787980364630190",
"184555795574186087419558859431104000587",
"176802997700730710890318700899418080898",
"217761325529572131324103145559538025017",
"127597309823861468951355853432182083559"
]
},
"deprecated": false,
"id": "CVE-2022-50452-97694eeb",
"target": {
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25087212304424645005304787980364630190",
"184555795574186087419558859431104000587",
"176802997700730710890318700899418080898",
"217761325529572131324103145559538025017",
"127597309823861468951355853432182083559"
]
},
"deprecated": false,
"id": "CVE-2022-50452-9ebc056e",
"target": {
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc8301ea7e7f1bb9d2ba2fcdf7b5ec2f0792b47e",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25087212304424645005304787980364630190",
"184555795574186087419558859431104000587",
"176802997700730710890318700899418080898",
"217761325529572131324103145559538025017",
"127597309823861468951355853432182083559"
]
},
"deprecated": false,
"id": "CVE-2022-50452-af41c2ae",
"target": {
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@154f4c06d9dbec1a14e91286c70b6305810302e0",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "277379765150868468096432641722875092905",
"length": 129.0
},
"deprecated": false,
"id": "CVE-2022-50452-c8a753cc",
"target": {
"function": "cake_reset",
"file": "net/sched/sch_cake.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1dc0a019550fd38ec6cab2d73c90df2bd659c96b",
"signature_version": "v1"
}
]