| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-37875: igc: fix PTM cycle trigger logic |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| igc: fix PTM cycle trigger logic |
| |
| Writing to clear the PTM status 'valid' bit while the PTM cycle is |
| triggered results in unreliable PTM operation. To fix this, clear the |
| PTM 'trigger' and status after each PTM transaction. |
| |
| The issue can be reproduced with the following: |
| |
| $ sudo phc2sys -R 1000 -O 0 -i tsn0 -m |
| |
| Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to |
| quickly reproduce the issue. |
| |
| PHC2SYS exits with: |
| |
| "ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction |
| fails |
| |
| This patch also fixes a hang in igc_probe() when loading the igc |
| driver in the kdump kernel on systems supporting PTM. |
| |
| The igc driver running in the base kernel enables PTM trigger in |
| igc_probe(). Therefore the driver is always in PTM trigger mode, |
| except in brief periods when manually triggering a PTM cycle. |
| |
| When a crash occurs, the NIC is reset while PTM trigger is enabled. |
| Due to a hardware problem, the NIC is subsequently in a bad busmaster |
| state and doesn't handle register reads/writes. When running |
| igc_probe() in the kdump kernel, the first register access to a NIC |
| register hangs driver probing and ultimately breaks kdump. |
| |
| With this patch, igc has PTM trigger disabled most of the time, |
| and the trigger is only enabled for very brief (10 - 100 us) periods |
| when manually triggering a PTM cycle. Chances that a crash occurs |
| during a PTM trigger are not 0, but extremely reduced. |
| |
| The Linux kernel CVE team has assigned CVE-2025-37875 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.15 with commit a90ec84837325df4b9a6798c2cc0df202b5680bd and fixed in 5.15.181 with commit c1f174edaccc5a00f8e218c42a0aa9156efd5f76 |
| Issue introduced in 5.15 with commit a90ec84837325df4b9a6798c2cc0df202b5680bd and fixed in 6.1.135 with commit 0c03e4fbe1321697d9d04587e21e416705e1b19f |
| Issue introduced in 5.15 with commit a90ec84837325df4b9a6798c2cc0df202b5680bd and fixed in 6.6.88 with commit 16194ca3f3b4448a062650c869a7b3b206c6f5d3 |
| Issue introduced in 5.15 with commit a90ec84837325df4b9a6798c2cc0df202b5680bd and fixed in 6.12.25 with commit f3516229cd12dcd45f23ed01adab17e8772b1bd5 |
| Issue introduced in 5.15 with commit a90ec84837325df4b9a6798c2cc0df202b5680bd and fixed in 6.14.4 with commit 31959e06143692f7e02b8eef7d7d6ac645637906 |
| Issue introduced in 5.15 with commit a90ec84837325df4b9a6798c2cc0df202b5680bd and fixed in 6.15 with commit 8e404ad95d2c10c261e2ef6992c7c12dde03df0e |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-37875 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/intel/igc/igc_defines.h |
| drivers/net/ethernet/intel/igc/igc_ptp.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/c1f174edaccc5a00f8e218c42a0aa9156efd5f76 |
| https://git.kernel.org/stable/c/0c03e4fbe1321697d9d04587e21e416705e1b19f |
| https://git.kernel.org/stable/c/16194ca3f3b4448a062650c869a7b3b206c6f5d3 |
| https://git.kernel.org/stable/c/f3516229cd12dcd45f23ed01adab17e8772b1bd5 |
| https://git.kernel.org/stable/c/31959e06143692f7e02b8eef7d7d6ac645637906 |
| https://git.kernel.org/stable/c/8e404ad95d2c10c261e2ef6992c7c12dde03df0e |
