CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0
RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113
Call Trace:
<TASK>
skb_over_panic net/core/skbuff.c:118 [inline]
skb_put.cold+0x24/0x24 net/core/skbuff.c:1990
isotp_rcv_cf net/can/isotp.c:570 [inline]
isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668
deliver net/can/af_can.c:574 [inline]
can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635
can_receive+0x31d/0x580 net/can/af_can.c:665
can_rcv+0x120/0x1c0 net/can/af_can.c:696
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465
__netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579
Therefore we make sure the state changes and data structures stay
consistent at CAN frame reception time by adding a spin_lock in
isotp_rcv(). This fixes the issue reported by syzkaller but does not
affect real world operation.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 20.04 | noarch | linux-intel-iotg-5.15 | < any | UNKNOWN |
git.kernel.org/linus/7c759040c1dd03954f650f147ae7175476d51314 (5.17-rc4)
git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30
git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca
git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314
git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3
launchpad.net/bugs/cve/CVE-2022-48830
nvd.nist.gov/vuln/detail/CVE-2022-48830
security-tracker.debian.org/tracker/CVE-2022-48830
www.cve.org/CVERecord?id=CVE-2022-48830