CVE-2022-48675— IB/core: Fix a nested dead lock as part of ODP flow
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-48675
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IB/core: Fix a nested dead lock as part of ODP flow
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: IB/core: Fix a nested dead lock as part of ODP flow Fix a nested dead lock as part of ODP flow by using mmput_async(). From the below call trace [1] can see that calling mmput() once we have the umem_odp->umem_mutex locked as required by ib_umem_odp_map_dma_and_lock() might trigger in the same task the exit_mmap()->__mmu_notifier_release()->mlx5_ib_invalidate_range() which may dead lock when trying to lock the same mutex. Moving to use mmput_async() will solve the problem as the above exit_mmap() flow will be called in other task and will be executed once the lock will be available. [1] [64843.077665] task:kworker/u133:2 state:D stack: 0 pid:80906 ppid: 2 flags:0x00004000 [64843.077672] Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] [64843.077719] Call Trace: [64843.077722] <TASK> [64843.077724] __schedule+0x23d/0x590 [64843.077729] schedule+0x4e/0xb0 [64843.077735] schedule_preempt_disabled+0xe/0x10 [64843.077740] __mutex_lock.constprop.0+0x263/0x490 [64843.077747] __mutex_lock_slowpath+0x13/0x20 [64843.077752] mutex_lock+0x34/0x40 [64843.077758] mlx5_ib_invalidate_range+0x48/0x270 [mlx5_ib] [64843.077808] __mmu_notifier_release+0x1a4/0x200 [64843.077816] exit_mmap+0x1bc/0x200 [64843.077822] ? walk_page_range+0x9c/0x120 [64843.077828] ? __cond_resched+0x1a/0x50 [64843.077833] ? mutex_lock+0x13/0x40 [64843.077839] ? uprobe_clear_state+0xac/0x120 [64843.077860] mmput+0x5f/0x140 [64843.077867] ib_umem_odp_map_dma_and_lock+0x21b/0x580 [ib_core] [64843.077931] pagefault_real_mr+0x9a/0x140 [mlx5_ib] [64843.077962] pagefault_mr+0xb4/0x550 [mlx5_ib] [64843.077992] pagefault_single_data_segment.constprop.0+0x2ac/0x560 [mlx5_ib] [64843.078022] mlx5_ib_eqe_pf_action+0x528/0x780 [mlx5_ib] [64843.078051] process_one_work+0x22b/0x3d0 [64843.078059] worker_thread+0x53/0x410 [64843.078065] ? process_one_work+0x3d0/0x3d0 [64843.078073] kthread+0x12a/0x150 [64843.078079] ? set_kthread_struct+0x50/0x50 [64843.078085] ret_from_fork+0x22/0x30 [64843.078093] </TASK>
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于出现死锁问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-48675
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-48675
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-05-03 · 25 CVEs total
| CVE-2022-48694 | RDMA/irdma: Fix drain SQ hang with no completion | |
| CVE-2022-48705 | wifi: mt76: mt7921e: fix crash in chip reset fail | |
| CVE-2022-48704 | drm/radeon: add a force flush to delay work when radeon | |
| CVE-2022-48695 | scsi: mpt3sas: Fix use-after-free warning | |
| CVE-2022-48690 | ice: Fix DMA mappings leak | |
| CVE-2022-48703 | thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR | |
| CVE-2022-48702 | ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() | |
| CVE-2022-48701 | ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() | |
| CVE-2022-48699 | sched/debug: fix dentry leak in update_sched_domain_debugfs | |
| CVE-2022-48698 | drm/amd/display: fix memory leak when using debugfs_lookup() | |
| CVE-2022-48697 | nvmet: fix a use-after-free | |
| CVE-2022-48696 | regmap: spi: Reserve space for register address/padding | |
| CVE-2022-48670 | peci: cpu: Fix use-after-free in adev_release() | |
| CVE-2022-48693 | soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs | |
| CVE-2022-48692 | RDMA/srp: Set scmnd->result only when scmnd is not NULL | |
| CVE-2022-48691 | netfilter: nf_tables: clean up hook list when offload flags check fails | |
| CVE-2022-48689 | tcp: TX zerocopy should not sense pfmemalloc status | |
| CVE-2022-48688 | i40e: Fix kernel crash during module removal | |
| CVE-2022-48687 | ipv6: sr: fix out-of-bounds read when setting HMAC data. | |
| CVE-2022-48686 | nvme-tcp: fix UAF when detecting digest errors |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2022-48675
No comments yet