| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47592: net: stmmac: fix tc flower deletion for VLAN priority Rx steering |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: stmmac: fix tc flower deletion for VLAN priority Rx steering |
| |
| To replicate the issue:- |
| |
| 1) Add 1 flower filter for VLAN Priority based frame steering:- |
| $ IFDEVNAME=eth0 |
| $ tc qdisc add dev $IFDEVNAME ingress |
| $ tc qdisc add dev $IFDEVNAME root mqprio num_tc 8 \ |
| map 0 1 2 3 4 5 6 7 0 0 0 0 0 0 0 0 \ |
| queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 |
| $ tc filter add dev $IFDEVNAME parent ffff: protocol 802.1Q \ |
| flower vlan_prio 0 hw_tc 0 |
| |
| 2) Get the 'pref' id |
| $ tc filter show dev $IFDEVNAME ingress |
| |
| 3) Delete a specific tc flower record (say pref 49151) |
| $ tc filter del dev $IFDEVNAME parent ffff: pref 49151 |
| |
| From dmesg, we will observe kernel NULL pointer ooops |
| |
| [ 197.170464] BUG: kernel NULL pointer dereference, address: 0000000000000000 |
| [ 197.171367] #PF: supervisor read access in kernel mode |
| [ 197.171367] #PF: error_code(0x0000) - not-present page |
| [ 197.171367] PGD 0 P4D 0 |
| [ 197.171367] Oops: 0000 [#1] PREEMPT SMP NOPTI |
| |
| <snip> |
| |
| [ 197.171367] RIP: 0010:tc_setup_cls+0x20b/0x4a0 [stmmac] |
| |
| <snip> |
| |
| [ 197.171367] Call Trace: |
| [ 197.171367] <TASK> |
| [ 197.171367] ? __stmmac_disable_all_queues+0xa8/0xe0 [stmmac] |
| [ 197.171367] stmmac_setup_tc_block_cb+0x70/0x110 [stmmac] |
| [ 197.171367] tc_setup_cb_destroy+0xb3/0x180 |
| [ 197.171367] fl_hw_destroy_filter+0x94/0xc0 [cls_flower] |
| |
| The above issue is due to previous incorrect implementation of |
| tc_del_vlan_flow(), shown below, that uses flow_cls_offload_flow_rule() |
| to get struct flow_rule *rule which is no longer valid for tc filter |
| delete operation. |
| |
| struct flow_rule *rule = flow_cls_offload_flow_rule(cls); |
| struct flow_dissector *dissector = rule->match.dissector; |
| |
| So, to ensure tc_del_vlan_flow() deletes the right VLAN cls record for |
| earlier configured RX queue (configured by hw_tc) in tc_add_vlan_flow(), |
| this patch introduces stmmac_rfs_entry as driver-side flow_cls_offload |
| record for 'RX frame steering' tc flower, currently used for VLAN |
| priority. The implementation has taken consideration for future extension |
| to include other type RX frame steering such as EtherType based. |
| |
| v2: |
| - Clean up overly extensive backtrace and rewrite git message to better |
| explain the kernel NULL pointer issue. |
| |
| The Linux kernel CVE team has assigned CVE-2021-47592 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.13 with commit 0e039f5cf86ce2fcb62077a163e7ff3d7b7b7cf3 and fixed in 5.15.11 with commit 97cb5c82aa1dd85a39b1bd021c8b5f18af623779 |
| Issue introduced in 5.13 with commit 0e039f5cf86ce2fcb62077a163e7ff3d7b7b7cf3 and fixed in 5.16 with commit aeb7c75cb77478fdbf821628e9c95c4baa9adc63 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47592 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/stmicro/stmmac/stmmac.h |
| drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/97cb5c82aa1dd85a39b1bd021c8b5f18af623779 |
| https://git.kernel.org/stable/c/aeb7c75cb77478fdbf821628e9c95c4baa9adc63 |
