NACK/Cmnt: [SRU][J][PATCH 0/1] CVE-2022-49722

[Edoardo Canepa]

Rejected for the following reasons:

The hunk applies to the right place, compiles, and the return-type 
conversion is correct. But the NULL guard it carries over is inert in 
jammy because this tree's `ice_get_vf_vsi()` lacks the `ICE_NO_VSI → 
NULL` check that upstream had when the fix was written, which converts 
the guarded path into an out-of-bounds array read plus a wild-pointer 
dereference. That needs a one-line adaptation before this goes in. 
`cf90b74341ee` should come along with it; `f23df5220d2b` is worth 
considering; `67f6317dfa60` is not applicable. The [Fix] section also 
needs cleaning up.

On 9/9/26 06:10, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2022-49722
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> ice: Fix memory corruption in VF driver
>
> Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when
> it requests a reset. If PF driver assumes that VF is disabled, while VF still
> has queues configured, VF may unmap DMA resources. In such scenario device
> still can map packets to memory, which ends up silently corrupting it.
> Previously, VF driver could experience memory corruption, which lead to crash:
> [ 5119.170157] BUG: unable to handle kernel paging request at 00001b9780003237
> [ 5119.170166] PGD 0 P4D 0 [ 5119.170173] Oops: 0002 [#1] PREEMPT_RT SMP PTI [
> 5119.170181] CPU: 30 PID: 427592 Comm: kworker/u96:2 Kdump: loaded Tainted: G W
> I --------- - - 4.18.0-372.9.1.rt7.166.el8.x86_64 #1 [ 5119.170189] Hardware
> name: Dell Inc. PowerEdge R740/014X06, BIOS 2.3.10 08/15/2019 [ 5119.170193]
> Workqueue: iavf iavf_adminq_task [iavf] [ 5119.170219] RIP:
> 0010:__page_frag_cache_drain+0x5/0x30 [ 5119.170238] Code: 0f 0f b6 77 51 85 f6
> 74 07 31 d2 e9 05 df ff ff e9 90 fe ff ff 48 8b 05 49 db 33 01 eb b4 0f 1f 80
> 00 00 00 00 0f 1f 44 00 00 <f0> 29 77 34 74 01 c3 48 8b 07 f6 c4 80 74 0f 0f b6
> 77 51 85 f6 74 [ 5119.170244] RSP: 0018:ffffa43b0bdcfd78 EFLAGS: 00010282 [
> 5119.170250] RAX: ffffffff896b3e40 RBX: ffff8fb282524000 RCX: 0000000000000002
> [ 5119.170254] RDX: 0000000049000000 RSI: 0000000000000000 RDI:
> 00001b9780003203 [ 5119.170259] RBP: ffff8fb248217b00 R08: 0000000000000022
> R09: 0000000000000009 [ 5119.170262] R10: 2b849d6300000000 R11:
> 0000000000000020 R12: 0000000000000000 [ 5119.170265] R13: 0000000000001000
> R14: 0000000000000009 R15: 0000000000000000 [ 5119.170269] FS:
> 0000000000000000(0000) GS:ffff8fb1201c0000(0000) knlGS:0000000000000000 [
> 5119.170274] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5119.170279]
> CR2: 00001b9780003237 CR3: 00000008f3e1a003 CR4: 00000000007726e0 [
> 5119.170283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 5119.170286] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> 0000000000000400 [ 5119.170290] PKRU: 55555554 [ 5119.170292] Call Trace: [
> 5119.170298] iavf_clean_rx_ring+0xad/0x110 [iavf] [ 5119.170324]
> iavf_free_rx_resources+0xe/0x50 [iavf] [ 5119.170342]
> iavf_free_all_rx_resources.part.51+0x30/0x40 [iavf] [ 5119.170358]
> iavf_virtchnl_completion+0xd8a/0x15b0 [iavf] [ 5119.170377] ?
> iavf_clean_arq_element+0x210/0x280 [iavf] [ 5119.170397]
> iavf_adminq_task+0x126/0x2e0 [iavf] [ 5119.170416] process_one_work+0x18f/0x420
> [ 5119.170429] worker_thread+0x30/0x370 [ 5119.170437] ?
> process_one_work+0x420/0x420 [ 5119.170445] kthread+0x151/0x170 [ 5119.170452]
> ? set_kthread_struct+0x40/0x40 [ 5119.170460] ret_from_fork+0x35/0x40 [
> 5119.170477] Modules linked in: iavf sctp ip6_udp_tunnel udp_tunnel mlx4_en
> mlx4_core nfp tls vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM
> ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter
> nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables
> nfnetlink bridge stp llc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs
> lockd grace fscache sunrpc intel_rapl_msr iTCO_wdt iTCO_vendor_support
> dell_smbios wmi_bmof dell_wmi_descriptor dcdbas kvm_intel kvm irqbypass
> intel_rapl_common isst_if_common skx_edac irdma nfit libnvdimm
> x86_pkg_temp_thermal i40e intel_powerclamp coretemp crct10dif_pclmul
> crc32_pclmul ghash_clmulni_intel ib_uverbs rapl ipmi_ssif intel_cstate
> intel_uncore mei_me pcspkr acpi_ipmi ib_core mei lpc_ich i2c_i801 ipmi_si
> ipmi_devintf wmi ipmi_msghandler acpi_power_meter xfs libcrc32c sd_mod t10_pi
> sg mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ice
> ahci drm libahci crc32c_intel libata tg3 megaraid_sas [ 5119.170613]
> i2c_algo_bit dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: iavf]
> [ 5119.170627] CR2: 00001b9780003237
>
> The ice PF driver could treat a VF as disabled while that VF still had its
> RX/TX queues configured. Because the device could keep mapping received
> packets into memory whose DMA mappings had already been torn down, this led
> to silent memory corruption and, as shown above, a kernel crash.
>
> [ Fix ]
>
> jammy/linux: backported from efe41860008e; iavf iavf_adminq_task [iavf
>
> The fix disables a VF's RX and TX queues when the VF is disabled, so that the
> device stops writing packets into memory before the associated DMA resources
> can be unmapped.
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression would be confined to the Intel ice driver and would show up on
> hosts using Intel E800-series network adapters with SR-IOV virtual functions,
> particularly during VF reset in virtualization workloads; a bad fix could
> disrupt VF queue handling or connectivity. Systems without the ice driver, or
> that do not use SR-IOV VFs, are not affected.
>
> [ Other Info ]
>
> Kybele flow-v11-21-g0f091652. Reference: b31a5375/v1
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260914/6f3f0f6c/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260914/6f3f0f6c/attachment.sig>