cve/published/2021/CVE-2021-47440.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2021-47440: net: encx24j600: check error in devm_regmap_init_encx24j600

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: encx24j600: check error in devm_regmap_init_encx24j600

devm_regmap_init may return error which caused by like out of memory,
this will results in null pointer dereference later when reading
or writing register:

general protection fault in encx24j600_spi_probe
KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
CPU: 0 PID: 286 Comm: spi-encx24j600- Not tainted 5.15.0-rc2-00142-g9978db750e31-dirty #11 9c53a778c1306b1b02359f3c2bbedc0222cba652
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:regcache_cache_bypass drivers/base/regmap/regcache.c:540
Code: 54 41 89 f4 55 53 48 89 fb 48 83 ec 08 e8 26 94 a8 fe 48 8d bb a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4a 03 00 00 4c 8d ab b0 00 00 00 48 8b ab a0 00
RSP: 0018:ffffc900010476b8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 0000000000000000
RDX: 0000000000000012 RSI: ffff888002de0000 RDI: 0000000000000094
RBP: ffff888013c9a000 R08: 0000000000000000 R09: fffffbfff3f9cc6a
R10: ffffc900010476e8 R11: fffffbfff3f9cc69 R12: 0000000000000001
R13: 000000000000000a R14: ffff888013c9af54 R15: ffff888013c9ad08
FS:  00007ffa984ab580(0000) GS:ffff88801fe00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a6384136c8 CR3: 000000003bbe6003 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 encx24j600_spi_probe drivers/net/ethernet/microchip/encx24j600.c:459
 spi_probe drivers/spi/spi.c:397
 really_probe drivers/base/dd.c:517
 __driver_probe_device drivers/base/dd.c:751
 driver_probe_device drivers/base/dd.c:782
 __device_attach_driver drivers/base/dd.c:899
 bus_for_each_drv drivers/base/bus.c:427
 __device_attach drivers/base/dd.c:971
 bus_probe_device drivers/base/bus.c:487
 device_add drivers/base/core.c:3364
 __spi_add_device drivers/spi/spi.c:599
 spi_add_device drivers/spi/spi.c:641
 spi_new_device drivers/spi/spi.c:717
 new_device_store+0x18c/0x1f1 [spi_stub 4e02719357f1ff33f5a43d00630982840568e85e]
 dev_attr_store drivers/base/core.c:2074
 sysfs_kf_write fs/sysfs/file.c:139
 kernfs_fop_write_iter fs/kernfs/file.c:300
 new_sync_write fs/read_write.c:508 (discriminator 4)
 vfs_write fs/read_write.c:594
 ksys_write fs/read_write.c:648
 do_syscall_64 arch/x86/entry/common.c:50
 entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:113

Add error check in devm_regmap_init_encx24j600 to avoid this situation.

The Linux kernel CVE team has assigned CVE-2021-47440 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.4 with commit 04fbfce7a222327b97ca165294ef19f0faa45960 and fixed in 4.4.290 with commit 66358471fa75a713fd76bc8a4bd74cb14cd50a4f
	Issue introduced in 4.4 with commit 04fbfce7a222327b97ca165294ef19f0faa45960 and fixed in 4.9.288 with commit f043fac1133a6c5ef960a8422c0f6dd711dee462
	Issue introduced in 4.4 with commit 04fbfce7a222327b97ca165294ef19f0faa45960 and fixed in 4.14.252 with commit fddc7f678d7fb93caa0d7bc512f968ff1e2bddbc
	Issue introduced in 4.4 with commit 04fbfce7a222327b97ca165294ef19f0faa45960 and fixed in 4.19.213 with commit 5e5494e6fc8a29c927e0478bec4a078a40da8901
	Issue introduced in 4.4 with commit 04fbfce7a222327b97ca165294ef19f0faa45960 and fixed in 5.4.155 with commit 4c2eb80fc90b05559ce6ed1b8dfb2348420b5644
	Issue introduced in 4.4 with commit 04fbfce7a222327b97ca165294ef19f0faa45960 and fixed in 5.10.75 with commit e19c10d6e07c59c96e90fe053a72683ad8b0397e
	Issue introduced in 4.4 with commit 04fbfce7a222327b97ca165294ef19f0faa45960 and fixed in 5.14.14 with commit 322c0e53496309e634d9db7349678eaad1d25b55
	Issue introduced in 4.4 with commit 04fbfce7a222327b97ca165294ef19f0faa45960 and fixed in 5.15 with commit f03dca0c9e2297c84a018e306f8a9cd534ee4287

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47440
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/microchip/encx24j600-regmap.c
	drivers/net/ethernet/microchip/encx24j600.c
	drivers/net/ethernet/microchip/encx24j600_hw.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/66358471fa75a713fd76bc8a4bd74cb14cd50a4f
	https://git.kernel.org/stable/c/f043fac1133a6c5ef960a8422c0f6dd711dee462
	https://git.kernel.org/stable/c/fddc7f678d7fb93caa0d7bc512f968ff1e2bddbc
	https://git.kernel.org/stable/c/5e5494e6fc8a29c927e0478bec4a078a40da8901
	https://git.kernel.org/stable/c/4c2eb80fc90b05559ce6ed1b8dfb2348420b5644
	https://git.kernel.org/stable/c/e19c10d6e07c59c96e90fe053a72683ad8b0397e
	https://git.kernel.org/stable/c/322c0e53496309e634d9db7349678eaad1d25b55
	https://git.kernel.org/stable/c/f03dca0c9e2297c84a018e306f8a9cd534ee4287