CVE-2022-49667

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: bonding: fix use-after-free after 802.3ad slave unbind<br /> <br /> commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"),<br /> resolve case, when there is several aggregation groups in the same bond.<br /> bond_3ad_unbind_slave will invalidate (clear) aggregator when<br /> __agg_active_ports return zero. So, ad_clear_agg can be executed even, when<br /> num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,<br /> previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave<br /> will not update slave ports list, because lag_ports==NULL. So, here we<br /> got slave ports, pointing to freed aggregator memory.<br /> <br /> Fix with checking actual number of ports in group (as was before<br /> commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ),<br /> before ad_clear_agg().<br /> <br /> The KASAN logs are as follows:<br /> <br /> [ 767.617392] ==================================================================<br /> [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470<br /> [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767<br /> [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15<br /> [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)<br /> [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler<br /> [ 767.666468] Call trace:<br /> [ 767.668930] dump_backtrace+0x0/0x2d0<br /> [ 767.672625] show_stack+0x24/0x30<br /> [ 767.675965] dump_stack_lvl+0x68/0x84<br /> [ 767.679659] print_address_description.constprop.0+0x74/0x2b8<br /> [ 767.685451] kasan_report+0x1f0/0x260<br /> [ 767.689148] __asan_load2+0x94/0xd0<br /> [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470