CVE-2022-49810

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix missing xas_retry() calls in xarray iteration

netfslib has a number of places in which it performs iteration of an xarray

whilst being under the RCU read lock. It *should* call xas_retry() as the

first thing inside of the loop and do "continue" if it returns true in case

the xarray walker passed out a special value indicating that the walk needs

to be redone from the root[*].

Fix this by adding the missing retry checks.

[*] I wonder if this should be done inside xas_find(), xas_next_node() and

suchlike, but I'm told that's not an simple change to effect.

This can cause an oops like that below. Note the faulting address - this

is an internal value (|0x2) returned from xarray.

BUG: kernel NULL pointer dereference, address: 0000000000000402

...

RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs]

...

Call Trace:

netfs_rreq_assess+0xa6/0x240 [netfs]

netfs_readpage+0x173/0x3b0 [netfs]

? init_wait_var_ent

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References