CVE-2022-48840: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48840 affects the Linux kernel's iavf driver. The vulnerability was introduced by commit 974578017fc1 which added a wait-loop at the beginning of iavfremove() to ensure port initialization completion before unregistering the network device. This causes a regression during reboot/shutdown scenarios where the iavfshutdown() callback detaches the device and sets its state to _IAVFREMOVE (Kernel Git).

The issue occurs because during shutdown, the iavfshutdown() callback is called first, which detaches the device and sets its state to _IAVFREMOVE. Later, when the shutdown callback of the associated PF driver (e.g. iceshutdown) is called, it triggers sriovdisable() which indirectly calls iavfremove(). Since the adapter state is already _IAVFREMOVE, the wait-loop becomes endless and the shutdown process hangs (Kernel Git).

The vulnerability causes the system to hang during reboot or shutdown operations when using the iavf driver with SR-IOV virtual functions. This prevents the system from completing the shutdown process normally (Kernel Git).

The fix involves checking the adapter's state at the beginning of iavf_remove() and skipping the rest of the function if the adapter is already in remove state (shutdown is in progress). This patch has been merged into the Linux kernel (Kernel Git).