CVE-2022-48865

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tipc: fix kernel panic when enabling bearer<br /> <br /> When enabling a bearer on a node, a kernel panic is observed:<br /> <br /> [ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc]<br /> ...<br /> [ 4.520030] Call Trace:<br /> [ 4.520689] <br /> [ 4.521236] tipc_link_build_proto_msg+0x375/0x750 [tipc]<br /> [ 4.522654] tipc_link_build_state_msg+0x48/0xc0 [tipc]<br /> [ 4.524034] __tipc_node_link_up+0xd7/0x290 [tipc]<br /> [ 4.525292] tipc_rcv+0x5da/0x730 [tipc]<br /> [ 4.526346] ? __netif_receive_skb_core+0xb7/0xfc0<br /> [ 4.527601] tipc_l2_rcv_msg+0x5e/0x90 [tipc]<br /> [ 4.528737] __netif_receive_skb_list_core+0x20b/0x260<br /> [ 4.530068] netif_receive_skb_list_internal+0x1bf/0x2e0<br /> [ 4.531450] ? dev_gro_receive+0x4c2/0x680<br /> [ 4.532512] napi_complete_done+0x6f/0x180<br /> [ 4.533570] virtnet_poll+0x29c/0x42e [virtio_net]<br /> ...<br /> <br /> The node in question is receiving activate messages in another<br /> thread after changing bearer status to allow message sending/<br /> receiving in current thread:<br /> <br /> thread 1 | thread 2<br /> -------- | --------<br /> |<br /> tipc_enable_bearer() |<br /> test_and_set_bit_lock() |<br /> tipc_bearer_xmit_skb() |<br /> | tipc_l2_rcv_msg()<br /> | tipc_rcv()<br /> | __tipc_node_link_up()<br /> | tipc_link_build_state_msg()<br /> | tipc_link_build_proto_msg()<br /> | tipc_mon_prep()<br /> | {<br /> | ...<br /> | // null-pointer dereference<br /> | u16 gen = mon-&gt;dom_gen;<br /> | ...<br /> | }<br /> // Not being executed yet |<br /> tipc_mon_create() |<br /> { |<br /> ... |<br /> // allocate |<br /> mon = kzalloc(); |<br /> ... |<br /> } |<br /> <br /> Monitoring pointer in thread 2 is dereferenced before monitoring data<br /> is allocated in thread 1. This causes kernel panic.<br /> <br /> This commit fixes it by allocating the monitoring data before enabling<br /> the bearer to receive messages.