CVE-2022-50356

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: sfb: fix null pointer access issue when sfb_init() fails

When the default qdisc is sfb, if the qdisc of dev_queue fails to be

inited during mqprio_init(), sfb_reset() is invoked to clear resources.

In this case, the q->qdisc is NULL, and it will cause gpf issue.

The process is as follows:

qdisc_create_dflt()

sfb_init()

tcf_block_get() --->failed, q->qdisc is NULL

...

qdisc_put()

...

sfb_reset()

qdisc_reset(q->qdisc) --->q->qdisc is NULL

ops = qdisc->ops

The following is the Call Trace information:

general protection fault, probably for non-canonical address

0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]

RIP: 0010:qdisc_reset+0x2b/0x6f0

Call Trace:

<TASK>

sfb_reset+0x37/0xd0

qdisc_reset+0xed/0x6f0

qdisc_destroy+0x82/0x4c0

qdisc_put+0x9e/0xb0

qdisc_create_dflt+0x2c3/0x4a0

mqprio_init+0xa71/0x1760

qdisc_crea

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References