CVE-2022-48721

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: Forward wakeup to smc socket waitqueue after fallback

When we replace TCP with SMC and a fallback occurs, there may be

some socket waitqueue entries remaining in smc socket->wq, such

as eppoll_entries inserted by userspace applications.

After the fallback, data flows over TCP/IP and only clcsocket->wq

will be woken up. Applications can't be notified by the entries

which were inserted in smc socket->wq before fallback. So we need

a mechanism to wake up smc socket->wq at the same time if some

entries remaining in it.

The current workaround is to transfer the entries from smc socket->wq

to clcsock->wq during the fallback. But this may cause a crash

like this:

general protection fault, probably for non-canonical address 0xdead000000000100: 0000 [#1] PREEMPT SMP PTI

CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Tainted: G E 5.16.0+ #107

RIP: 0010:__wake_up_common+0x65/0x170

Call Trace:

<IRQ>

__wake_u

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References