CVE-2022-48840: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48840 affects the Linux kernel's iavf driver. The vulnerability was introduced by commit 974578017fc1 which added a wait-loop at the beginning of iavf_remove() to ensure port initialization completion before unregistering the network device. This causes a regression during reboot/shutdown scenarios where the iavf_shutdown() callback detaches the device and sets its state to __IAVF_REMOVE (Kernel Git).

The issue occurs because during shutdown, the iavf_shutdown() callback is called first, which detaches the device and sets its state to __IAVF_REMOVE. Later, when the shutdown callback of the associated PF driver (e.g. ice_shutdown) is called, it triggers sriov_disable() which indirectly calls iavf_remove(). Since the adapter state is already __IAVF_REMOVE, the wait-loop becomes endless and the shutdown process hangs (Kernel Git).

The vulnerability causes the system to hang during reboot or shutdown operations when using the iavf driver with SR-IOV virtual functions. This prevents the system from completing the shutdown process normally (Kernel Git).

The issue can be reproduced by: 1) Creating a VF on PF driven by ice or i40e driver, 2) Ensuring the VF is bound to iavf driver, and 3) Initiating a system reboot (Kernel Git).

The fix involves checking the adapter's state at the beginning of iavf_remove() and skipping the rest of the function if the adapter is already in remove state (shutdown is in progress). This patch has been merged into the Linux kernel (Kernel Git).