CVE-2022-49443: list: fix a data-race around ep->rdllist
In the Linux kernel, the following vulnerability has been resolved:
list: fix a data-race around ep->rdllist
eppoll() first calls epeventsavailable() with no lock held and checks if ep->rdllist is empty by listemptycareful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing.
Note INITLISTHEADRCU() already has the annotation for both prev and next.
Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless epeventsavailable(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epollwait()") made some epeventsavailable() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last epeventsavailable() lockless.
BUG: KCSAN: data-race in doepollwait / doepollwait
write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INITLISTHEAD include/linux/list.h:38 [inline] listspliceinit include/linux/list.h:492 [inline] epstartscan fs/eventpoll.c:622 [inline] epsendevents fs/eventpoll.c:1656 [inline] eppoll fs/eventpoll.c:1806 [inline] doepollwait+0x4eb/0xf40 fs/eventpoll.c:2234 doepollpwait fs/eventpoll.c:2268 [inline] dosysepollpwait fs/eventpoll.c:2281 [inline] sesysepollpwait+0x12b/0x240 fs/eventpoll.c:2275 x64sysepollpwait+0x74/0x80 fs/eventpoll.c:2275 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x44/0xd0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: listemptycareful include/linux/list.h:329 [inline] epeventsavailable fs/eventpoll.c:381 [inline] eppoll fs/eventpoll.c:1797 [inline] doepollwait+0x279/0xf40 fs/eventpoll.c:2234 doepollpwait fs/eventpoll.c:2268 [inline] dosysepollpwait fs/eventpoll.c:2281 [inline] sesysepollpwait+0x12b/0x240 fs/eventpoll.c:2275 x64sysepollpwait+0x74/0x80 fs/eventpoll.c:2275 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x44/0xd0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
value changed: 0xffff88810480c7d0 -> 0xffff888103c15098
Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Other sources
In the Linux kernel, the following vulnerability has been resolved:
list: fix a data-race around ep-rdllist
eppoll() first calls epeventsavailable() with no lock held and checks if ep-rdllist is empty by listemptycareful(), which reads rdllist-prev. Thus all accesses to it need some protection to avoid store/load-tearing.
Note INITLISTHEADRCU() already has the annotation for both prev and next.
Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless epeventsavailable(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epollwait()") made some epeventsavailable() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last epeventsavailable() lockless.
BUG: KCSAN: data-race in doepollwait / doepollwait
write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INITLISTHEAD include/linux/list.h:38 [inline] listspliceinit include/linux/list.h:492 [inline] epstartscan fs/eventpoll.c:622 [inline] epsendevents fs/eventpoll.c:1656 [inline] eppoll fs/eventpoll.c:1806 [inline] doepollwait+0x4eb/0xf40 fs/eventpoll.c:2234 doepollpwait fs/eventpoll.c:2268 [inline] dosysepollpwait fs/eventpoll.c:2281 [inline] sesysepollpwait+0x12b/0x240 fs/eventpoll.c:2275 x64sysepollpwait+0x74/0x80 fs/eventpoll.c:2275 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x44/0xd0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: listemptycareful include/linux/list.h:329 [inline] epeventsavailable fs/eventpoll.c:381 [inline] eppoll fs/eventpoll.c:1797 [inline] doepollwait+0x279/0xf40 fs/eventpoll.c:2234 doepollpwait fs/eventpoll.c:2268 [inline] dosysepollpwait fs/eventpoll.c:2281 [inline] sesysepollpwait+0x12b/0x240 fs/eventpoll.c:2275 x64sysepollpwait+0x74/0x80 fs/eventpoll.c:2275 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x44/0xd0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
value changed: 0xffff88810480c7d0 - 0xffff888103c15098
Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49443?
CVE-2022-49443 has a medium severity rating of 4.7 according to the CVSS 3.1 framework.
How do I fix CVE-2022-49443?
To fix CVE-2022-49443, ensure that your Linux kernel is updated to the latest patched version that addresses the data-race condition.
What type of vulnerability is CVE-2022-49443?
CVE-2022-49443 is identified as a race condition vulnerability in the Linux kernel.
What software is affected by CVE-2022-49443?
CVE-2022-49443 affects the Linux kernel and various IBM products including IBM Verify Identity Access and IBM Security Verify Access.
When was CVE-2022-49443 published?
CVE-2022-49443 was published on February 26, 2025.