Bug 2348214 (CVE-2022-49433) - CVE-2022-49433 kernel: RDMA/hfi1: Prevent use of lock before it is initialized
Summary: CVE-2022-49433 kernel: RDMA/hfi1: Prevent use of lock before it is initialized
Keywords:
Status: NEW
Alias: CVE-2022-49433
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-26 03:21 UTC by OSIDB Bzimport
Modified: 2025-06-06 07:40 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-26 03:21:36 UTC
In the Linux kernel, the following vulnerability has been resolved:

RDMA/hfi1: Prevent use of lock before it is initialized

If there is a failure during probe of hfi1 before the sdma_map_lock is
initialized, the call to hfi1_free_devdata() will attempt to use a lock
that has not been initialized. If the locking correctness validator is on
then an INFO message and stack trace resembling the following may be seen:

  INFO: trying to register non-static key.
  The code is fine but needs lockdep annotation, or maybe
  you didn't initialize this object before use?
  turning off the locking correctness validator.
  Call Trace:
  register_lock_class+0x11b/0x880
  __lock_acquire+0xf3/0x7930
  lock_acquire+0xff/0x2d0
  _raw_spin_lock_irq+0x46/0x60
  sdma_clean+0x42a/0x660 [hfi1]
  hfi1_free_devdata+0x3a7/0x420 [hfi1]
  init_one+0x867/0x11a0 [hfi1]
  pci_device_probe+0x40e/0x8d0

The use of sdma_map_lock in sdma_clean() is for freeing the sdma_map
memory, and sdma_map is not allocated/initialized until after
sdma_map_lock has been initialized. This code only needs to be run if
sdma_map is not NULL, and so checking for that condition will avoid trying
to use the lock before it is initialized.

Comment 1 Avinash Hanwate 2025-02-26 12:35:26 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022656-CVE-2022-49433-5ef1@gregkh/T

Comment 4 Avinash Hanwate 2025-02-26 16:57:50 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022656-CVE-2022-49433-5ef1@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.