CVE-2022-49889

ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()

Medium · published May 1, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()

On some machines the number of listed CPUs may be bigger than the actual

CPUs that exist. The tracing subsystem allocates a per_cpu directory with

access to the per CPU ring buffer via a cpuX file. But to save space, the

ring buffer will only allocate buffers for online CPUs, even though the

CPU array will be as big as the nr_cpu_ids.

With the addition of waking waiters on the ring buffer when closing the

file, the ring_buffer_wake_waiters() now needs to make sure that the

buffer is allocated (with the irq_work allocated with it) before trying to

wake waiters, as it will cause a NULL pointer dereference.

While debugging this, I added a NULL check for the buffer itself (which is

OK to do), and also NULL pointer checks against buffer->buffers (which is

not fine, and will WARN) as well as making sure the CPU number passed in

is within the nr_cpu_ids (which is also not fine if it isn't).

Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1204705

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.4th percentile
Published
2025-05-01T14:10Z
EPSS history
Timeline
  • 01 MAY 14:10Z
    ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()
    cvelistv5