CVE-2022-48644

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: avoid disabling offload when it was never enabled

In an incredibly strange API design decision, qdisc->destroy() gets

called even if qdisc->init() never succeeded, not exclusively since

commit 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation"),

but apparently also earlier (in the case of qdisc_create_dflt()).

The taprio qdisc does not fully acknowledge this when it attempts full

offload, because it starts off with q->flags = TAPRIO_FLAGS_INVALID in

taprio_init(), then it replaces q->flags with TCA_TAPRIO_ATTR_FLAGS

parsed from netlink (in taprio_change(), tail called from taprio_init()).

But in taprio_destroy(), we call taprio_disable_offload(), and this

determines what to do based on FULL_OFFLOAD_IS_ENABLED(q->flags).

But looking at the implementation of FULL_OFFLOAD_IS_ENABLED()

(a bitwise check of bit 1 in q->flags), it is invalid to call this macro

on q->flags when it contains

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References