tree 6ab5e3cb0c49d11220e824066f7cc6f022c79a6a
parent 6fce47cde715809c31009f4848cbb3b2c1f16a2b
author Sasha Levin <sashal@kernel.org> 1749471670 -0400
committer Sasha Levin <sashal@kernel.org> 1749471670 -0400

CVE-2024-56785: Add .vulnerable file

The root cause was introduced in commit
24af105962c8004edb9f5bf84bc587cbb30e52de (July 9, 2020) by Jiaxun Yang,
which initially created the arch/mips/boot/dts/loongson/ls7a-pch.dtsi
file.

Technical Analysis of the Root Cause:

1. Incorrect node naming: The PCIe bridge nodes were named
   pci_bridge@X,0 instead of the correct pcie@X,0. According to Device
   Tree conventions, PCIe ports should use the "pcie" node name.

2. Missing critical PCI bridge properties: The PCIe bridge nodes lacked
   essential properties required for proper PCI bridge operation:
   - #address-cells = <3> - Required for PCI address translation
   - #size-cells = <2> - Required for PCI size specification
   - device_type = "pci" - Required to identify the node as a PCI bus
   - ranges - Required for address translation between parent and child
     address spaces

3. Incorrect interrupt cell configuration: The parent PCI node had
   #interrupt-cells = <2> which was incorrect for this configuration and
   caused dtc warnings about the node not being an interrupt provider.

Chain of Events:

1. July 2020: Commit 24af105962c80 introduced the ls7a-pch.dtsi file
   with these structural issues in the PCIe bridge definitions.

2. March 2021: A similar issue existed in the ls2k DTS file
   (loongson64-2k1000.dtsi), introduced in commit b1a792601f264.

3. May 2024: Commit d89a415ff8d5 fixed the issue for ls2k devices but
   had a misleading commit subject that claimed to fix ls7a (it only
   fixed loongson64-2k1000.dtsi).

4. November 2024: Commit 045b14ca5c36 added stricter warnings in the OF
   core code for missing #address-cells/#size-cells, which exposed the
   latent issues more prominently at runtime.

5. November 2024: Finally, commit 4fbd66d8254c properly fixed the ls7a
   issues that had been present since the file's introduction.

The bug remained latent for over 4 years because:
- The missing properties didn't cause immediate failures but resulted
  in warnings
- The Device Tree compiler (dtc) warnings were likely ignored or not
  prominent enough
- The runtime impact was minimal until stricter OF validation was added
- There was confusion between ls2k and ls7a fixes (as evidenced by the
  misleading commit message in d89a415ff8d5)

This is a classic example of how Device Tree specification violations
can persist for years until stricter validation exposes them, and how
misleading commit messages can cause confusion about what was actually
fixed.

Signed-off-by: Sasha Levin <sashal@kernel.org>