CVE-2022-48976

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable_offload: fix using __this_cpu_add in preemptible

flow_offload_queue_work() can be called in workqueue without

bh disabled, like the call trace showed in my act_ct testing,

calling NF_FLOW_TABLE_STAT_INC() there would cause a call

trace:

BUG: using __this_cpu_add() in preemptible [00000000] code: kworker/u4:0/138560

caller is flow_offload_queue_work+0xec/0x1b0 [nf_flow_table]

Workqueue: act_ct_workqueue tcf_ct_flow_table_cleanup_work [act_ct]

Call Trace:

<TASK>

dump_stack_lvl+0x33/0x46

check_preemption_disabled+0xc3/0xf0

flow_offload_queue_work+0xec/0x1b0 [nf_flow_table]

nf_flow_table_iterate+0x138/0x170 [nf_flow_table]

nf_flow_table_free+0x140/0x1a0 [nf_flow_table]

tcf_ct_flow_table_cleanup_work+0x2f/0x2b0 [act_ct]

process_one_work+0x6a3/0x1030

worker_thread+0x8a/0xdf0

This patch fixes it by using NF_FLOW_TABLE_STAT_INC_ATOMIC()

instead in flow_offload_queue_w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References