CVE-2022-50291

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kcm: annotate data-races around kcm->rx_psock

kcm->rx_psock can be read locklessly in kcm_rfree().

Annotate the read and writes accordingly.

We do the same for kcm->rx_wait in the following patch.

syzbot reported:

BUG: KCSAN: data-race in kcm_rfree / unreserve_rx_kcm

write to 0xffff888123d827b8 of 8 bytes by task 2758 on cpu 1:

unreserve_rx_kcm+0x72/0x1f0 net/kcm/kcmsock.c:313

kcm_rcv_strparser+0x2b5/0x3a0 net/kcm/kcmsock.c:373

__strp_recv+0x64c/0xd20 net/strparser/strparser.c:301

strp_recv+0x6d/0x80 net/strparser/strparser.c:335

tcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703

strp_read_sock net/strparser/strparser.c:358 [inline]

do_strp_work net/strparser/strparser.c:406 [inline]

strp_work+0xe8/0x180 net/strparser/strparser.c:415

process_one_work+0x3d3/0x720 kernel/workqueue.c:2289

worker_thread+0x618/0xa70 kernel/workqueue.c:2436

kthread+0x1a9/0x1e0 kernel/kthread.c:376

ret_from_fork+0x1f/0x30 arch/x86/entry/entry

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References