CVE-2022-50363

In the Linux kernel, the following vulnerability has been resolved:

skmsg: pass gfp argument to alloc_sk_msg()

syzbot found that alloc_sk_msg() could be called from a
non sleepable context. sk_psock_verdict_recv() uses
rcu_read_lock() protection.

We need the callers to pass a gfp_t argument to avoid issues.

syzbot report was:

BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3613, name: syz-executor414
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
CPU: 0 PID: 3613 Comm: syz-executor414 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
__might_resched+0x538/0x6a0 kernel/sched/core.c:9877
might_alloc include/linux/sched/mm.h:274 [inline]
slab_pre_alloc_hook mm/slab.h:700 [inline]
slab_alloc_node mm/slub.c:3162 [inline]
slab_alloc mm/slub.c:3256 [inline]
kmem_cache_alloc_trace+0x59/0x310 mm/slub.c:3287
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
alloc_sk_msg net/core/skmsg.c:507 [inline]
sk_psock_skb_ingress_self+0x5c/0x330 net/core/skmsg.c:600
sk_psock_verdict_apply+0x395/0x440 net/core/skmsg.c:1014
sk_psock_verdict_recv+0x34d/0x560 net/core/skmsg.c:1201
tcp_read_skb+0x4a1/0x790 net/ipv4/tcp.c:1770
tcp_rcv_established+0x129d/0x1a10 net/ipv4/tcp_input.c:5971
tcp_v4_do_rcv+0x479/0xac0 net/ipv4/tcp_ipv4.c:1681
sk_backlog_rcv include/net/sock.h:1109 [inline]
__release_sock+0x1d8/0x4c0 net/core/sock.c:2906
release_sock+0x5d/0x1c0 net/core/sock.c:3462
tcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1483
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]
__sys_sendto+0x46d/0x5f0 net/socket.c:2117
__do_sys_sendto net/socket.c:2129 [inline]
__se_sys_sendto net/socket.c:2125 [inline]
__x64_sys_sendto+0xda/0xf0 net/socket.c:2125
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
LinuxCNA
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 6%
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
not-affected
bullseye (security)
5.10.237-1
fixed
bookworm
6.1.148-1
fixed
bookworm (security)
6.1.147-1
fixed
trixie
6.12.43-1
fixed
trixie (security)
6.12.41-1
fixed
forky
6.16.7-1
fixed
sid
6.16.7-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-hwe
plucky
dne
noble
dne
jammy
dne
bionic
ignored
xenial
needs-triage
linux-hwe-5.4
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-hwe-5.8
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.11
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.13
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-hwe-5.19
plucky
dne
noble
dne
jammy
ignored
linux-hwe-6.2
plucky
dne
noble
dne
jammy
ignored
linux-hwe-6.5
plucky
dne
noble
dne
jammy
ignored
linux-hwe-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-hwe-6.11
plucky
dne
noble
ignored
jammy
dne
linux-hwe-6.14
plucky
dne
noble
needs-triage
jammy
dne
linux-hwe-edge
plucky
dne
noble
dne
jammy
dne
bionic
ignored
xenial
ignored
linux-lts-xenial
plucky
dne
noble
dne
jammy
dne
trusty
needs-triage
linux-kvm
plucky
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-allwinner-5.19
plucky
dne
noble
dne
jammy
ignored
linux-aws
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-aws-5.0
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-aws-5.3
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-aws-5.4
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-aws-5.8
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.11
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.13
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-aws-5.19
plucky
dne
noble
dne
jammy
ignored
linux-aws-6.2
plucky
dne
noble
dne
jammy
ignored
linux-aws-6.5
plucky
dne
noble
dne
jammy
ignored
linux-aws-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-aws-6.14
plucky
dne
noble
needs-triage
jammy
dne
linux-aws-hwe
plucky
dne
noble
dne
jammy
dne
xenial
needs-triage
linux-azure
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
trusty
needs-triage
linux-azure-4.15
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-azure-5.3
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-azure-5.4
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-azure-5.8
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.11
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.13
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-5.19
plucky
dne
noble
dne
jammy
ignored
linux-azure-6.2
plucky
dne
noble
dne
jammy
ignored
linux-azure-6.5
plucky
dne
noble
dne
jammy
ignored
linux-azure-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-azure-6.11
plucky
dne
noble
ignored
jammy
dne
linux-azure-fde
plucky
dne
noble
dne
jammy
needs-triage
focal
ignored
linux-azure-fde-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-fde-5.19
plucky
dne
noble
dne
jammy
ignored
linux-azure-fde-6.2
plucky
dne
noble
dne
jammy
ignored
linux-azure-nvidia
plucky
dne
noble
needs-triage
jammy
dne
linux-bluefield
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-edge
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-fips
plucky
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-aws-fips
plucky
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-azure-fips
plucky
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-gcp-fips
plucky
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-gcp
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
linux-gcp-4.15
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-gcp-5.3
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-gcp-5.4
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-gcp-5.8
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.11
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.13
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-gcp-5.19
plucky
dne
noble
dne
jammy
ignored
linux-gcp-6.2
plucky
dne
noble
dne
jammy
ignored
linux-gcp-6.5
plucky
dne
noble
dne
jammy
ignored
linux-gcp-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-gcp-6.11
plucky
dne
noble
ignored
jammy
dne
linux-gcp-6.14
plucky
dne
noble
needs-triage
jammy
dne
linux-gke
plucky
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gke-4.15
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-gke-5.4
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-gke-5.15
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-gkeop
plucky
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gkeop-5.4
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-gkeop-5.15
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-ibm
plucky
dne
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-ibm-5.4
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-ibm-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-ibm-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-intel-5.13
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-intel-iotg
plucky
dne
noble
dne
jammy
needs-triage
linux-intel-iotg-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-iot
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-intel-iot-realtime
plucky
dne
noble
dne
jammy
needs-triage
linux-lowlatency
plucky
dne
noble
needs-triage
jammy
needs-triage
linux-lowlatency-hwe-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-lowlatency-hwe-5.19
plucky
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.2
plucky
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.5
plucky
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-lowlatency-hwe-6.11
plucky
dne
noble
ignored
jammy
dne
linux-nvidia
plucky
dne
noble
needs-triage
jammy
needs-triage
linux-nvidia-6.2
plucky
dne
noble
dne
jammy
ignored
linux-nvidia-6.5
plucky
dne
noble
dne
jammy
ignored
linux-nvidia-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-nvidia-6.11
plucky
dne
noble
needs-triage
jammy
dne
linux-nvidia-lowlatency
plucky
dne
noble
needs-triage
jammy
dne
linux-nvidia-tegra
plucky
dne
noble
needs-triage
jammy
needs-triage
linux-nvidia-tegra-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-nvidia-tegra-igx
plucky
dne
noble
dne
jammy
needs-triage
linux-oracle
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-oracle-5.0
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-oracle-5.3
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-oracle-5.4
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-oracle-5.8
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.11
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.13
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-oracle-6.5
plucky
dne
noble
dne
jammy
ignored
linux-oracle-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-oracle-6.14
plucky
dne
noble
needs-triage
jammy
dne
linux-oem
plucky
dne
noble
dne
jammy
dne
bionic
ignored
linux-oem-5.6
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.10
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.13
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.14
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.17
plucky
dne
noble
dne
jammy
ignored
linux-oem-6.0
plucky
dne
noble
dne
jammy
ignored
linux-oem-6.1
plucky
dne
noble
dne
jammy
ignored
linux-oem-6.5
plucky
dne
noble
dne
jammy
ignored
linux-oem-6.8
plucky
dne
noble
needs-triage
jammy
dne
linux-oem-6.11
plucky
dne
noble
needs-triage
jammy
dne
linux-oem-6.14
plucky
dne
noble
needs-triage
jammy
dne
linux-raspi
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-raspi2
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-raspi-5.4
plucky
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-raspi-realtime
plucky
dne
noble
needs-triage
jammy
dne
linux-realtime
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
linux-realtime-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-realtime-6.14
plucky
dne
noble
needs-triage
jammy
dne
linux-riscv
plucky
needs-triage
noble
ignored
jammy
ignored
focal
ignored
linux-riscv-5.8
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-5.11
plucky
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-5.15
plucky
dne
noble
dne
jammy
dne
focal
needs-triage
linux-riscv-5.19
plucky
dne
noble
dne
jammy
ignored
linux-riscv-6.5
plucky
dne
noble
dne
jammy
ignored
linux-riscv-6.8
plucky
dne
noble
dne
jammy
needs-triage
linux-riscv-6.14
plucky
dne
noble
needs-triage
jammy
dne
linux-starfive-5.19
plucky
dne
noble
dne
jammy
ignored
linux-starfive-6.2
plucky
dne
noble
dne
jammy
ignored
linux-starfive-6.5
plucky
dne
noble
dne
jammy
ignored
linux-xilinx-zynqmp
plucky
dne
noble
dne
jammy
needs-triage
focal
needs-triage