CVE-2022-48689

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: TX zerocopy should not sense pfmemalloc status

We got a recent syzbot report [1] showing a possible misuse

of pfmemalloc page status in TCP zerocopy paths.

Indeed, for pages coming from user space or other layers,

using page_is_pfmemalloc() is moot, and possibly could give

false positives.

There has been attempts to make page_is_pfmemalloc() more robust,

but not using it in the first place in this context is probably better,

removing cpu cycles.

Note to stable teams :

You need to backport 84ce071e38a6 ("net: introduce

__skb_fill_page_desc_noacc") as a prereq.

Race is more probable after commit c07aea3ef4d4

("mm: add a signature in struct page") because page_is_pfmemalloc()

is now using low order bit from page->lru.next, which can change

more often than page->index.

Low order bit should never be set for lru.next (when used as an anchor

in LRU list), so KCSAN report is mostly a false positive.

Backporting t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References