From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D570321660F for ; Wed, 26 Feb 2025 02:14:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536048; cv=none; b=ZR1/V7cF+4lOHCtJxhCSDFA0kZl+obXOFMhOA2D+OgkW9AIjAQPDebqJyzHv230GGVCtDqP/nAzBkGsJWPgT824gSNJyDDyoe7v+LZ1vAWLEUVmCTUAzuO77YTTAZZx1/3B0a3Cr3PsJVpttIvT+sD1ssyr1nEbbr1U569xLNI0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536048; c=relaxed/simple; bh=CxpQlMiFv4NMixM8D5UAVCTtoSw313HBMbU8ayvVmfw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=KmbyW+Z0h6fD5VtplUjqo402/KU9rntijT4qxOf/In8u1YBj6uw29bbOnQkl+b8siW6kNgUCnEtsscqQteJA/YBNddS9NxUP1uR9HocizsOlnxrhphsTOSQ7CcEU2H1/z3WsZBE0m6RQJiYuuoiRZIr7dJDg0dbZ/qOSQsQp8bE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hPLugYu/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="hPLugYu/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ABBF7C4CEDD; Wed, 26 Feb 2025 02:14:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536048; bh=CxpQlMiFv4NMixM8D5UAVCTtoSw313HBMbU8ayvVmfw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=hPLugYu/MnyDbA+z4dVpz5w3fUqZMX6zHesMqNNE0s+NcZ9OXCxwN/vChErMCx+Q3 T6M+0FqaawyWS3XN4KfsIzkfJhHQzBk9QlRqdpUojgKypcXF6bItC03usDfRgVCGIZ ago5XWxsGd1JZkPd8zdmNuFExCIXDpf7nsNP6+Rk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if Date: Wed, 26 Feb 2025 03:11:34 +0100 Message-ID: <2025022654-CVE-2022-49420-2ad4@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3635; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=CxpQlMiFv4NMixM8D5UAVCTtoSw313HBMbU8ayvVmfw=; b=kA0DAAIRMUfUDdst+ykByyZiAGe+d/KiD67lnly1KMhHsTF6ByqBv9roeGatsDNQgCyyatRVJ IhdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAme+d/IACgkQMUfUDdst+ykHBQCgvTY4 Jz9V0T0mT7YirBfE3IYDmgkAn2VKPDTvTcU++8bltLxCtbipvQ+U X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net: annotate races around sk->sk_bound_dev_if UDP sendmsg() is lockless, and reads sk->sk_bound_dev_if while this field can be changed by another thread. Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add more annotations to potential lockless readers. BUG: KCSAN: data-race in __ip6_datagram_connect / udpv6_sendmsg write to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0: __ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272 inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576 __sys_connect_file net/socket.c:1900 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1917 __do_sys_connect net/socket.c:1927 [inline] __se_sys_connect net/socket.c:1924 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:1924 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1: udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000000 -> 0xffffff9b Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G W 5.18.0-rc1-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 I chose to not add Fixes: tag because race has minor consequences and stable teams busy enough. The Linux kernel CVE team has assigned CVE-2022-49420 to this issue. Affected and fixed versions =========================== Fixed in 5.18.3 with commit 20b2f61797873a2b18b5ff1a304ad2674fa1e0a5 Fixed in 5.19 with commit 4c971d2f3548e4f11b1460ac048f5307e4b39fdb Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49420 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/net/ip.h include/net/sock.h net/ipv6/datagram.c net/ipv6/udp.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/20b2f61797873a2b18b5ff1a304ad2674fa1e0a5 https://git.kernel.org/stable/c/4c971d2f3548e4f11b1460ac048f5307e4b39fdb