CVE-2022-48868 (GCVE-0-2022-48868)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:09 – Updated: 2025-05-04 08:25
VLAI?
Title
dmaengine: idxd: Let probe fail when workqueue cannot be enabled
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Let probe fail when workqueue cannot be enabled The workqueue is enabled when the appropriate driver is loaded and disabled when the driver is removed. When the driver is removed it assumes that the workqueue was enabled successfully and proceeds to free allocations made during workqueue enabling. Failure during workqueue enabling does not prevent the driver from being loaded. This is because the error path within drv_enable_wq() returns success unless a second failure is encountered during the error path. By returning success it is possible to load the driver even if the workqueue cannot be enabled and allocations that do not exist are attempted to be freed during driver remove. Some examples of problematic flows: (a) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_unmap_portal() is called on error exit path, but drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The driver is thus loaded successfully. idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal() Above flow on driver unload triggers the WARN in devm_iounmap() because the device resource has already been removed during error path of drv_enable_wq(). (b) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_init_percpu_ref() is never called to initialize the percpu counter, yet the driver loads successfully because drv_enable_wq() returns 0. idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill(): Above flow on driver unload triggers a BUG when attempting to drop the initial ref of the uninitialized percpu ref: BUG: kernel NULL pointer dereference, address: 0000000000000010 Fix the drv_enable_wq() error path by returning the original error that indicates failure of workqueue enabling. This ensures that the probe fails when an error is encountered and the driver remove paths are only attempted when the workqueue was enabled successfully.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1f2bb40337f0df1d9af80793e9fdacff7706e654 , < 0f150134dd795ffcd60b798a85ab737d8d010fb7 (git)
Affected: 1f2bb40337f0df1d9af80793e9fdacff7706e654 , < 99dc4520b74e7ca8e9dc9abe37a0b10b49467960 (git)
Affected: 1f2bb40337f0df1d9af80793e9fdacff7706e654 , < b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f (git)
Create a notification for this product.
    Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.90 , ≤ 5.15.* (semver)
Unaffected: 6.1.8 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48868",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:05:38.503495Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:54.625Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f150134dd795ffcd60b798a85ab737d8d010fb7",
              "status": "affected",
              "version": "1f2bb40337f0df1d9af80793e9fdacff7706e654",
              "versionType": "git"
            },
            {
              "lessThan": "99dc4520b74e7ca8e9dc9abe37a0b10b49467960",
              "status": "affected",
              "version": "1f2bb40337f0df1d9af80793e9fdacff7706e654",
              "versionType": "git"
            },
            {
              "lessThan": "b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f",
              "status": "affected",
              "version": "1f2bb40337f0df1d9af80793e9fdacff7706e654",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.90",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Let probe fail when workqueue cannot be enabled\n\nThe workqueue is enabled when the appropriate driver is loaded and\ndisabled when the driver is removed. When the driver is removed it\nassumes that the workqueue was enabled successfully and proceeds to\nfree allocations made during workqueue enabling.\n\nFailure during workqueue enabling does not prevent the driver from\nbeing loaded. This is because the error path within drv_enable_wq()\nreturns success unless a second failure is encountered\nduring the error path. By returning success it is possible to load\nthe driver even if the workqueue cannot be enabled and\nallocations that do not exist are attempted to be freed during\ndriver remove.\n\nSome examples of problematic flows:\n(a)\n\n idxd_dmaengine_drv_probe() -\u003e drv_enable_wq() -\u003e idxd_wq_request_irq():\n In above flow, if idxd_wq_request_irq() fails then\n idxd_wq_unmap_portal() is called on error exit path, but\n drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The\n driver is thus loaded successfully.\n\n idxd_dmaengine_drv_remove()-\u003edrv_disable_wq()-\u003eidxd_wq_unmap_portal()\n Above flow on driver unload triggers the WARN in devm_iounmap() because\n the device resource has already been removed during error path of\n drv_enable_wq().\n\n(b)\n\n idxd_dmaengine_drv_probe() -\u003e drv_enable_wq() -\u003e idxd_wq_request_irq():\n In above flow, if idxd_wq_request_irq() fails then\n idxd_wq_init_percpu_ref() is never called to initialize the percpu\n counter, yet the driver loads successfully because drv_enable_wq()\n returns 0.\n\n idxd_dmaengine_drv_remove()-\u003e__idxd_wq_quiesce()-\u003epercpu_ref_kill():\n Above flow on driver unload triggers a BUG when attempting to drop the\n initial ref of the uninitialized percpu ref:\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n\nFix the drv_enable_wq() error path by returning the original error that\nindicates failure of workqueue enabling. This ensures that the probe\nfails when an error is encountered and the driver remove paths are only\nattempted when the workqueue was enabled successfully."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:25:08.433Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f150134dd795ffcd60b798a85ab737d8d010fb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/99dc4520b74e7ca8e9dc9abe37a0b10b49467960"
        },
        {
          "url": "https://git.kernel.org/stable/c/b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f"
        }
      ],
      "title": "dmaengine: idxd: Let probe fail when workqueue cannot be enabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48868",
    "datePublished": "2024-08-21T06:09:58.431Z",
    "dateReserved": "2024-07-16T11:38:08.921Z",
    "dateUpdated": "2025-05-04T08:25:08.433Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48868\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:05:38.503495Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:11.965Z\"}}], \"cna\": {\"title\": \"dmaengine: idxd: Let probe fail when workqueue cannot be enabled\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1f2bb40337f0\", \"lessThan\": \"0f150134dd79\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1f2bb40337f0\", \"lessThan\": \"99dc4520b74e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1f2bb40337f0\", \"lessThan\": \"b51b75f0604f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/dma/idxd/device.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"5.15.90\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.8\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/dma/idxd/device.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0f150134dd795ffcd60b798a85ab737d8d010fb7\"}, {\"url\": \"https://git.kernel.org/stable/c/99dc4520b74e7ca8e9dc9abe37a0b10b49467960\"}, {\"url\": \"https://git.kernel.org/stable/c/b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Let probe fail when workqueue cannot be enabled\\n\\nThe workqueue is enabled when the appropriate driver is loaded and\\ndisabled when the driver is removed. When the driver is removed it\\nassumes that the workqueue was enabled successfully and proceeds to\\nfree allocations made during workqueue enabling.\\n\\nFailure during workqueue enabling does not prevent the driver from\\nbeing loaded. This is because the error path within drv_enable_wq()\\nreturns success unless a second failure is encountered\\nduring the error path. By returning success it is possible to load\\nthe driver even if the workqueue cannot be enabled and\\nallocations that do not exist are attempted to be freed during\\ndriver remove.\\n\\nSome examples of problematic flows:\\n(a)\\n\\n idxd_dmaengine_drv_probe() -\u003e drv_enable_wq() -\u003e idxd_wq_request_irq():\\n In above flow, if idxd_wq_request_irq() fails then\\n idxd_wq_unmap_portal() is called on error exit path, but\\n drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The\\n driver is thus loaded successfully.\\n\\n idxd_dmaengine_drv_remove()-\u003edrv_disable_wq()-\u003eidxd_wq_unmap_portal()\\n Above flow on driver unload triggers the WARN in devm_iounmap() because\\n the device resource has already been removed during error path of\\n drv_enable_wq().\\n\\n(b)\\n\\n idxd_dmaengine_drv_probe() -\u003e drv_enable_wq() -\u003e idxd_wq_request_irq():\\n In above flow, if idxd_wq_request_irq() fails then\\n idxd_wq_init_percpu_ref() is never called to initialize the percpu\\n counter, yet the driver loads successfully because drv_enable_wq()\\n returns 0.\\n\\n idxd_dmaengine_drv_remove()-\u003e__idxd_wq_quiesce()-\u003epercpu_ref_kill():\\n Above flow on driver unload triggers a BUG when attempting to drop the\\n initial ref of the uninitialized percpu ref:\\n BUG: kernel NULL pointer dereference, address: 0000000000000010\\n\\nFix the drv_enable_wq() error path by returning the original error that\\nindicates failure of workqueue enabling. This ensures that the probe\\nfails when an error is encountered and the driver remove paths are only\\nattempted when the workqueue was enabled successfully.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-08-21T06:09:58.431Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48868\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-12T17:32:54.625Z\", \"dateReserved\": \"2024-07-16T11:38:08.921Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T06:09:58.431Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.