linux-cve-announce - CVE-2022-49584: ixgbe: Add locking to prevent panic when setting sriov

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022608-CVE-2022-49584-ceae@gregkh>
Date: Wed, 26 Feb 2025 03:22:27 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49584: ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero

It is possible to disable VFs while the PF driver is processing requests
from the VF driver.  This can result in a panic.

BUG: unable to handle kernel paging request at 000000000000106c
PGD 0 P4D 0
Oops: 0000 [#1] SMP NOPTI
CPU: 8 PID: 0 Comm: swapper/8 Kdump: loaded Tainted: G I      --------- -
Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020
RIP: 0010:ixgbe_msg_task+0x4c8/0x1690 [ixgbe]
Code: 00 00 48 8d 04 40 48 c1 e0 05 89 7c 24 24 89 fd 48 89 44 24 10 83 ff
01 0f 84 b8 04 00 00 4c 8b 64 24 10 4d 03 a5 48 22 00 00 <41> 80 7c 24 4c
00 0f 84 8a 03 00 00 0f b7 c7 83 f8 08 0f 84 8f 0a
RSP: 0018:ffffb337869f8df8 EFLAGS: 00010002
RAX: 0000000000001020 RBX: 0000000000000000 RCX: 000000000000002b
RDX: 0000000000000002 RSI: 0000000000000008 RDI: 0000000000000006
RBP: 0000000000000006 R08: 0000000000000002 R09: 0000000000029780
R10: 00006957d8f42832 R11: 0000000000000000 R12: 0000000000001020
R13: ffff8a00e8978ac0 R14: 000000000000002b R15: ffff8a00e8979c80
FS:  0000000000000000(0000) GS:ffff8a07dfd00000(0000) knlGS:00000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000106c CR3: 0000000063e10004 CR4: 00000000007726e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <IRQ>
 ? ttwu_do_wakeup+0x19/0x140
 ? try_to_wake_up+0x1cd/0x550
 ? ixgbevf_update_xcast_mode+0x71/0xc0 [ixgbevf]
 ixgbe_msix_other+0x17e/0x310 [ixgbe]
 __handle_irq_event_percpu+0x40/0x180
 handle_irq_event_percpu+0x30/0x80
 handle_irq_event+0x36/0x53
 handle_edge_irq+0x82/0x190
 handle_irq+0x1c/0x30
 do_IRQ+0x49/0xd0
 common_interrupt+0xf/0xf

This can be eventually be reproduced with the following script:

while :
do
    echo 63 > /sys/class/net/<devname>/device/sriov_numvfs
    sleep 1
    echo 0 > /sys/class/net/<devname>/device/sriov_numvfs
    sleep 1
done

Add lock when disabling SR-IOV to prevent process VF mailbox communication.

The Linux kernel CVE team has assigned CVE-2022-49584 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.6 with commit d773d1310625be3b040b436178ad59a0af8888f1 and fixed in 5.4.208 with commit 031af9e617a6f51075d97e56fc9e712c7dde2508
	Issue introduced in 3.6 with commit d773d1310625be3b040b436178ad59a0af8888f1 and fixed in 5.10.134 with commit b82de63f8f817b5735480293dda8e92ba8170c52
	Issue introduced in 3.6 with commit d773d1310625be3b040b436178ad59a0af8888f1 and fixed in 5.15.58 with commit 16f929a5e76fd047fd8697e1e568bdd7d771955c
	Issue introduced in 3.6 with commit d773d1310625be3b040b436178ad59a0af8888f1 and fixed in 5.18.15 with commit 9d925d2dc82cec2bcbd8625457645d8a548ab22e
	Issue introduced in 3.6 with commit d773d1310625be3b040b436178ad59a0af8888f1 and fixed in 5.19 with commit 1e53834ce541d4fe271cdcca7703e50be0a44f8a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49584
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/intel/ixgbe/ixgbe.h
	drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
	drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/031af9e617a6f51075d97e56fc9e712c7dde2508
	https://git.kernel.org/stable/c/b82de63f8f817b5735480293dda8e92ba8170c52
	https://git.kernel.org/stable/c/16f929a5e76fd047fd8697e1e568bdd7d771955c
	https://git.kernel.org/stable/c/9d925d2dc82cec2bcbd8625457645d8a548ab22e
	https://git.kernel.org/stable/c/1e53834ce541d4fe271cdcca7703e50be0a44f8a