CVE-2022-49443

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> list: fix a data-race around ep-&gt;rdllist<br /> <br /> ep_poll() first calls ep_events_available() with no lock held and checks<br /> if ep-&gt;rdllist is empty by list_empty_careful(), which reads<br /> rdllist-&gt;prev. Thus all accesses to it need some protection to avoid<br /> store/load-tearing.<br /> <br /> Note INIT_LIST_HEAD_RCU() already has the annotation for both prev<br /> and next.<br /> <br /> Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket<br /> fds.") added the first lockless ep_events_available(), and commit<br /> c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()")<br /> made some ep_events_available() calls lockless and added single call under<br /> a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock<br /> for zero timeout") made the last ep_events_available() lockless.<br /> <br /> BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait<br /> <br /> write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0:<br /> INIT_LIST_HEAD include/linux/list.h:38 [inline]<br /> list_splice_init include/linux/list.h:492 [inline]<br /> ep_start_scan fs/eventpoll.c:622 [inline]<br /> ep_send_events fs/eventpoll.c:1656 [inline]<br /> ep_poll fs/eventpoll.c:1806 [inline]<br /> do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234<br /> do_epoll_pwait fs/eventpoll.c:2268 [inline]<br /> __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]<br /> __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275<br /> __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275<br /> do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br /> do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80<br /> entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> <br /> read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1:<br /> list_empty_careful include/linux/list.h:329 [inline]<br /> ep_events_available fs/eventpoll.c:381 [inline]<br /> ep_poll fs/eventpoll.c:1797 [inline]<br /> do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234<br /> do_epoll_pwait fs/eventpoll.c:2268 [inline]<br /> __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]<br /> __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275<br /> __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275<br /> do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br /> do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80<br /> entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> <br /> value changed: 0xffff88810480c7d0 -&gt; 0xffff888103c15098<br /> <br /> Reported by Kernel Concurrency Sanitizer on:<br /> CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011