CVE-2022-49443

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

list: fix a data-race around ep->rdllist

ep_poll() first calls ep_events_available() with no lock held and checks

if ep->rdllist is empty by list_empty_careful(), which reads

rdllist->prev. Thus all accesses to it need some protection to avoid

store/load-tearing.

Note INIT_LIST_HEAD_RCU() already has the annotation for both prev

and next.

Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket

fds.") added the first lockless ep_events_available(), and commit

c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()")

made some ep_events_available() calls lockless and added single call under

a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock

for zero timeout") made the last ep_events_available() lockless.

BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait

write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0:

INIT_LIST_HEAD include/linux/list.h:38 [inlin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References