Linux Kernel: slub Flush_cpu_slab Context Bug (CVE-2022-48658)
CVE-2022-48658 Published on April 28, 2024
mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context.
In the Linux kernel, the following vulnerability has been resolved:
mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context.
Commit 5a836bf6b09f ("mm: slub: move flush_cpu_slab() invocations
__free_slab() invocations out of IRQ context") moved all flush_cpu_slab()
invocations to the global workqueue to avoid a problem related
with deactivate_slab()/__free_slab() being called from an IRQ context
on PREEMPT_RT kernels.
When the flush_all_cpu_locked() function is called from a task context
it may happen that a workqueue with WQ_MEM_RECLAIM bit set ends up
flushing the global workqueue, this will cause a dependency issue.
workqueue: WQ_MEM_RECLAIM nvme-delete-wq:nvme_delete_ctrl_work [nvme_core]
is flushing !WQ_MEM_RECLAIM events:flush_cpu_slab
WARNING: CPU: 37 PID: 410 at kernel/workqueue.c:2637
check_flush_dependency+0x10a/0x120
Workqueue: nvme-delete-wq nvme_delete_ctrl_work [nvme_core]
RIP: 0010:check_flush_dependency+0x10a/0x120[ 453.262125] Call Trace:
__flush_work.isra.0+0xbf/0x220
? __queue_work+0x1dc/0x420
flush_all_cpus_locked+0xfb/0x120
__kmem_cache_shutdown+0x2b/0x320
kmem_cache_destroy+0x49/0x100
bioset_exit+0x143/0x190
blk_release_queue+0xb9/0x100
kobject_cleanup+0x37/0x130
nvme_fc_ctrl_free+0xc6/0x150 [nvme_fc]
nvme_free_ctrl+0x1ac/0x2b0 [nvme_core]
Fix this bug by creating a workqueue for the flush operation with
the WQ_MEM_RECLAIM bit set.
Products Associated with CVE-2022-48658
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Linux Kernel. Just hit a watch button to start following.
Affected Versions
Linux:- Version 5a836bf6b09f99ead1b69457ff39ab3011ece57b and below 61703b248be993eb4997b00ae5d3318e6d8f3c5b is affected.
- Version 5a836bf6b09f99ead1b69457ff39ab3011ece57b and below df6cb39335cf5a1b918e8dbd8ba7cd9f1d00e45a is affected.
- Version 5a836bf6b09f99ead1b69457ff39ab3011ece57b and below e45cc288724f0cfd497bb5920bcfa60caa335729 is affected.
- Version 5.15 is affected.
- Before 5.15 is unaffected.
- Version 5.15.71, <= 5.15.* is unaffected.
- Version 5.19.12, <= 5.19.* is unaffected.
- Version 6.0, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.