CVE: CVE-2022-50041
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: Fix call trace with null VSI during VF reset

During stress test with attaching and detaching VF from KVM and
simultaneously changing VFs spoofcheck and trust there was a
call trace in ice_reset_vf that VF's VSI is null.

[[PII_REDACTED]97] WARNING: CPU: 46 PID: 840629 at drivers/net/ethernet/intel/ice/ice_vf_lib.c:508 ice_reset_vf+0x3d6/0x410 [ice]
[[PII_REDACTED]51] Modules linked in: ice(E) vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio iavf dm_mod xt_CHECKSUM xt_MASQUERADE
xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun
 bridge stp llc sunrpc intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm iTCO_wdt iTC
O_vendor_support irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl ipmi_si intel_cstate ipmi_devintf joydev intel_uncore m
ei_me ipmi_msghandler i2c_i801 pcspkr mei lpc_ich ioatdma i2c_smbus acpi_pad acpi_power_meter ip_tables xfs libcrc32c i2c_algo_bit drm_sh
mem_helper drm_kms_helper sd_mod t10_pi crc64_rocksoft syscopyarea crc64 sysfillrect sg sysimgblt fb_sys_fops drm i40e ixgbe ahci libahci
 libata crc32c_intel mdio dca wmi fuse [last unloaded: ice]
[[PII_REDACTED]17] CPU: 46 PID: 840629 Comm: kworker/46:2 Tainted: G S      W I E     5.19.0-rc6+ #24
[[PII_REDACTED]21] Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0[PII_REDACTED]51325 02/11/2015
[[PII_REDACTED]23] Workqueue: ice ice_service_task [ice]
[[PII_REDACTED]48] RIP: 0010:ice_reset_vf+0x3d6/0x410 [ice]
[[PII_REDACTED]84] Code: 30 ec f3 cc e9 28 fd ff ff 0f b7 4b 50 48 c7 c2 48 19 9c c0 4c 89 ee 48 c7 c7 30 fe 9e c0 e8 d1 21 9d cc 31 c0 e9 a
9 fe ff ff <0f> 0b b8 ea ff ff ff e9 c1 fc ff ff 0f 0b b8 fb ff ff ff e9 91 fe
[[PII_REDACTED]87] RSP: 0018:ffffb453e257fdb8 EFLAGS: 00010246
[[PII_REDACTED]90] RAX: ffff8bd0040181c0 RBX: ffff8be68db8f800 RCX: [PII_REDACTED]
[[PII_REDACTED]91] RDX:[PII_REDACTED]00ffff RSI: [PII_REDACTED] RDI: ffff8be68db8f800
[[PII_REDACTED]93] RBP: ffff8bd0040181c0 R08: [PII_REDACTED] R09: ffff8bcfd520e000
[[PII_REDACTED]95] R10: [PII_REDACTED] R11: 00008417b5ab0bc0 R12: [PII_REDACTED]
[[PII_REDACTED]96] R13: ffff8bcee061c0d0 R14: ffff8bd004019640 R15: [PII_REDACTED]
[[PII_REDACTED]98] FS:  [PII_REDACTED](0000) GS:ffff8be5dfb00000(0000) knlGS:[PII_REDACTED]
[[PII_REDACTED]00] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[[PII_REDACTED]02] CR2: 00007fd81f651d68 CR3: 0000001a0fe10001 CR4:[PII_REDACTED]1726e0
[[PII_REDACTED]03] Call Trace:
[[PII_REDACTED]08]  <TASK>
[[PII_REDACTED]11]  ice_process_vflr_event+0x8d/0xb0 [ice]
[[PII_REDACTED]49]  ice_service_task+0x79f/0xef0 [ice]
[[PII_REDACTED]74]  process_one_work+0x1c8/0x390
[[PII_REDACTED]81]  ? process_one_work+0x390/0x390
[[PII_REDACTED]84]  worker_thread+0x30/0x360
[[PII_REDACTED]87]  ? process_one_work+0x390/0x390
[[PII_REDACTED]90]  kthread+0xe8/0x110
[[PII_REDACTED]94]  ? kthread_complete_and_exit+0x20/0x20
[[PII_REDACTED]97]  ret_from_fork+0x22/0x30
[[PII_REDACTED]03]  </TASK>

Remove WARN_ON() from check if VSI is null in ice_reset_vf.
Add "VF is already removed\n" in dev_dbg().

This WARN_ON() is unnecessary and causes call trace, despite that
call trace, driver still works. There is no need for this warn
because this piece of code is responsible for disabling VF's Tx/Rx
queues when VF is disabled, but when VF is already removed there
is no need to do reset or disable queues.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/af1b0d1547dd1686ae842cac7f3678649a5cbd89; https://git.kernel.org/stable/c/cf90b74341eecc32ceef0c136954a1668e43b1e7