Message-ID: <2024082218-CVE-2022-48921-5016@gregkh>
Date: Thu, 22 Aug 2024 11:31:22 +0800
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-48921: sched/fair: Fix fault in reweight_entity

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Fix fault in reweight_entity

Syzbot found a GPF in reweight_entity. This has been bisected to
commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid
sched_task_group")

There is a race between sched_post_fork() and setpriority(PRIO_PGRP)
within a thread group that causes a null-ptr-deref in
reweight_entity() in CFS. The scenario is that the main process spawns
number of new threads, which then call setpriority(PRIO_PGRP, 0, -20),
wait, and exit.  For each of the new threads the copy_process() gets
invoked, which adds the new task_struct and calls sched_post_fork()
for it.

In the above scenario there is a possibility that
setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread
in the group that is just being created by copy_process(), and for
which the sched_post_fork() has not been executed yet. This will
trigger a null pointer dereference in reweight_entity(), as it will
try to access the run queue pointer, which hasn't been set.

Before the mentioned change the cfs_rq pointer for the task  has been
set in sched_fork(), which is called much earlier in copy_process(),
before the new task is added to the thread_group.  Now it is done in
the sched_post_fork(), which is called after that.  To fix the issue
the remove the update_load param from the update_load param() function
and call reweight_task() only if the task flag doesn't have the
TASK_NEW flag set.

The Linux kernel CVE team has assigned CVE-2022-48921 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.80 with commit c85c6fadbef0 and fixed in 5.10.137 with commit 8f317cd88805
	Issue introduced in 5.15.3 with commit 3869eecf0504 and fixed in 5.15.27 with commit e0bcd6b57793
	Issue introduced in 5.16 with commit 4ef0c5c6b5ba and fixed in 5.16.13 with commit 589a954daab5
	Issue introduced in 5.16 with commit 4ef0c5c6b5ba and fixed in 5.17 with commit 13765de8148f
	Issue introduced in 5.14.19 with commit 25d40b828fb8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-48921
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/sched/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8f317cd888059c59e2fa924bf4b0957cfa53f78e
	https://git.kernel.org/stable/c/e0bcd6b5779352aed88f2e538a82a39f1a7715bb
	https://git.kernel.org/stable/c/589a954daab5e18399860b6c8ffaeaf79844eb20
	https://git.kernel.org/stable/c/13765de8148f71fa795e0a6607de37c49ea5915a

Powered by blists - more mailing lists