CVE-2022-49018: mptcp: fix sleep in atomic at close time
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix sleep in atomic at close time
Matt reported a splat at msk close time:
BUG: sleeping function called from invalid context at net/mptcp/protocol.c:2877 inatomic(): 1, irqsdisabled(): 0, nonblock: 0, pid: 155, name: packetdrill preemptcount: 201, expected: 0 RCU nest depth: 0, expected: 0 4 locks held by packetdrill/155: #0: ffff888001536990 (&sb->stype->imutexkey#6){+.+.}-{3:3}, at: sockrelease (net/socket.c:650) #1: ffff88800b498130 (sklock-AFINET){+.+.}-{0:0}, at: mptcpclose (net/mptcp/protocol.c:2973) #2: ffff88800b49a130 (sklock-AFINET/1){+.+.}-{0:0}, at: mptcpclosessk (net/mptcp/protocol.c:2363) #3: ffff88800b49a0b0 (slock-AFINET){+...}-{2:2}, at: locksockfast (include/net/sock.h:1820) Preemption disabled at: 0x0 CPU: 1 PID: 155 Comm: packetdrill Not tainted 6.1.0-rc5 #365 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dumpstacklvl (lib/dumpstack.c:107 (discriminator 4)) mightresched.cold (kernel/sched/core.c:9891) mptcpdestroysock (include/linux/kernel.h:110) mptcpclose (net/mptcp/protocol.c:2959) mptcpsubflowqueueclean (include/net/sock.h:1777) mptcpclosessk (net/mptcp/protocol.c:2363) mptcpdestroycommon (net/mptcp/protocol.c:3170) mptcpdestroy (include/net/sock.h:1495) mptcpdestroysock (net/mptcp/protocol.c:2886) mptcpclose (net/mptcp/protocol.c:2959) mptcpclose (net/mptcp/protocol.c:2974) inetrelease (net/ipv4/afinet.c:432) sockrelease (net/socket.c:651) sockclose (net/socket.c:1367) fput (fs/filetable.c:320) taskworkrun (kernel/taskwork.c:181 (discriminator 1)) exittousermodeprepare (include/linux/resumeusermode.h:49) syscallexittousermode (kernel/entry/common.c:130) dosyscall64 (arch/x86/entry/common.c:87) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:120)
We can't call mptcpclose under the 'fast' socket lock variant, replace it with a socklocknested() as the relevant code is already under the listening msk socket lock protection.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49018?
CVE-2022-49018 has a medium severity rating due to the risk of system instability during the MPTCP close process.
How do I fix CVE-2022-49018?
To fix CVE-2022-49018, apply the latest patches or updates available for your version of the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2022-49018?
CVE-2022-49018 affects Linux kernel versions from 5.19.14 to 6.0 and various 6.1 release candidates.
What exactly does CVE-2022-49018 exploit in the Linux kernel?
CVE-2022-49018 exploits a vulnerability that causes a sleep operation in an atomic context during the MPTCP close process.
Who reported the issue for CVE-2022-49018?
The issue for CVE-2022-49018 was reported by an individual named Matt.