CVE-2022-50363

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

skmsg: pass gfp argument to alloc_sk_msg()

syzbot found that alloc_sk_msg() could be called from a

non sleepable context. sk_psock_verdict_recv() uses

rcu_read_lock() protection.

We need the callers to pass a gfp_t argument to avoid issues.

syzbot report was:

BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274

in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3613, name: syz-executor414

preempt_count: 0, expected: 0

RCU nest depth: 1, expected: 0

INFO: lockdep is turned off.

CPU: 0 PID: 3613 Comm: syz-executor414 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106

__might_resched+0x538/0x6a0 kernel/sched/core.c:9877

might_alloc include/linux/sched/mm.h:274 [inline]

slab_pre_alloc_hook

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References