CVE-2022-50452

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: cake: fix null pointer access issue when cake_init() fails

When the default qdisc is cake, if the qdisc of dev_queue fails to be

inited during mqprio_init(), cake_reset() is invoked to clear

resources. In this case, the tins is NULL, and it will cause gpf issue.

The process is as follows:

qdisc_create_dflt()

cake_init()

q->tins = kvcalloc(...) --->failed, q->tins is NULL

...

qdisc_put()

...

cake_reset()

...

cake_dequeue_one()

b = &q->tins[...] --->q->tins is NULL

The following is the Call Trace information:

general protection fault, probably for non-canonical address

0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: 0010:cake_dequeue_one+0xc9/0x3c0

Call Trace:

<TASK>

cake_reset+0xb1/0x140

qdisc_reset+0xed/0x6f0

qdisc_destroy+0x82/0x4c0

qdisc_put+0x9e/0xb0

qdisc_create_dflt+0x2c3/0x4a0

mqprio_init+0xa71/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References