IB/core: Fix a nested dead lock as part of ODP flow

{
  "id": "178207b2574d18b9227f2edf83eff9ca9d2a908ad16463982299a952af32998e",
  "url": "https://osv.dev/vulnerability/CVE-2022-48675",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "IB/core: Fix a nested dead lock as part of ODP flow",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: IB/core: Fix a nested dead lock as part of ODP flow Fix a nested dead lock as part of ODP flow by using mmput_async(). From the below call trace [1] can see that calling mmput() once we have the umem_odp->umem_mutex locked as required by ib_umem_odp_map_dma_and_lock() might trigger in the same task the exit_mmap()->__mmu_notifier_release()->mlx5_ib_invalidate_range() which may dead lock when trying to lock the same mutex. Moving to use mmput_async() will solve the problem as the above exit_mmap() flow will be called in other task and will be executed once the lock will be available. [1] [64843.077665] task:kworker/u133:2 state:D stack: 0 pid:80906 ppid: 2 flags:0x00004000 [64843.077672] Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] [64843.077719] Call Trace: [64843.077722] [64843.077724] __schedule+0x23d/0x590 [64843.077729] schedule+0x4e/0xb0 [64843.077735] schedule_preempt_disabled+0xe/0x10 [64843.077740] __mutex_lock.constprop.0+0x263/0x490 [64843.077747] __mutex_lock_slowpath+0x13/0x20 [64843.077752] mutex_lock+0x34/0x40 [64843.077758] mlx5_ib_invalidate_range+0x48/0x270 [mlx5_ib] [64843.077808] __mmu_notifier_release+0x1a4/0x200 [64843.077816] exit_mmap+0x1bc/0x200 [64843.077822] ? walk_page_range+0x9c/0x120 [64843.077828] ? __cond_resched+0x1a/0x50 [64843.077833] ? mutex_lock+0x13/0x40 [64843.077839] ? uprobe_clear_state+0xac/0x120 [64843.077860] mmput+0x5f/0x140 [64843.077867] ib_umem_o",
    "evidence": "osv:CVE-2022-48675",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.143",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.68",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.19.9",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2022-48675",
      "aliases": [
        "CVE-2022-48675"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "36f30e486dce22345c2dd3a3ba439c12cd67f6ba"
                },
                {
                  "fixed": "e8de6cb5755eae7b793d8c00c8696c8667d44a7f"
                },
                {
                  "fixed": "819110054b14d7272b4188db997a3d80f75ab785"
                },
                {
                  "fixed": "83c43fd872e32c8071d5582eb7c40f573a8342f3"
                },
                {
                  "fixed": "85eaeb5058f0f04dffb124c97c86b4f18db0b833"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48675.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.10.0"
                },
                {
                  "fixed": "5.10.143"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.68"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "5.19.9"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48675.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:22.665607258Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/819110054b14d7272b4188db997a3d80f75ab785",
        "https://git.kernel.org/stable/c/83c43fd872e32c8071d5582eb7c40f573a8342f3",
        "https://git.kernel.org/stable/c/85eaeb5058f0f04dffb124c97c86b4f18db0b833",
        "https://git.kernel.org/stable/c/e8de6cb5755eae7b793d8c00c8696c8667d44a7f",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48675.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-48675",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48675.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-48675",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 488895,
  "published_at": "2024-05-03T14:52:06.518+00:00"
}