Bug 2347775 (CVE-2022-49429)

Summary:	CVE-2022-49429 kernel: RDMA/hfi1: Prevent panic when SDMA is disabled
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A possible NULL pointer dereference was observed in the Linux kernel in hfil module. This may lead to kernel panic and then crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-26 03:06:19 UTC

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hfi1: Prevent panic when SDMA is disabled

If the hfi1 module is loaded with HFI1_CAP_SDMA off, a call to
hfi1_write_iter() will dereference a NULL pointer and panic. A typical
stack frame is:

  sdma_select_user_engine [hfi1]
  hfi1_user_sdma_process_request [hfi1]
  hfi1_write_iter [hfi1]
  do_iter_readv_writev
  do_iter_write
  vfs_writev
  do_writev
  do_syscall_64

The fix is to test for SDMA in hfi1_write_iter() and fail the I/O with
EINVAL.

Comment 1 Avinash Hanwate 2025-02-26 11:04:53 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022655-CVE-2022-49429-c9a7@gregkh/T

Comment 3 Avinash Hanwate 2025-02-26 15:32:47 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022655-CVE-2022-49429-c9a7@gregkh/T