| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-48795: parisc: Fix data TLB miss in sba_unmap_sg |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| parisc: Fix data TLB miss in sba_unmap_sg |
| |
| Rolf Eike Beer reported the following bug: |
| |
| [1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018 |
| [1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4 |
| [1274934.746891] Hardware name: 9000/785/C8000 |
| [1274934.746891] |
| [1274934.746891] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI |
| [1274934.746891] PSW: 00001000000001001111111000001110 Not tainted |
| [1274934.746891] r00-03 000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000 |
| [1274934.746891] r04-07 0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001 |
| [1274934.746891] r08-11 0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001 |
| [1274934.746891] r12-15 0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0 |
| [1274934.746891] r16-19 0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007 |
| [1274934.746891] r20-23 0000000000000006 000000004a368950 0000000000000000 0000000000000001 |
| [1274934.746891] r24-27 0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0 |
| [1274934.746891] r28-31 0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118 |
| [1274934.746891] sr00-03 00000000066e5800 0000000000000000 0000000000000000 00000000066e5800 |
| [1274934.746891] sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 |
| [1274934.746891] |
| [1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec |
| [1274934.746891] IIR: 48780030 ISR: 0000000000000000 IOR: 0000004140000018 |
| [1274934.746891] CPU: 3 CR30: 00000040e3a9c000 CR31: ffffffffffffffff |
| [1274934.746891] ORIG_R28: 0000000040acdd58 |
| [1274934.746891] IAOQ[0]: sba_unmap_sg+0xb0/0x118 |
| [1274934.746891] IAOQ[1]: sba_unmap_sg+0xb4/0x118 |
| [1274934.746891] RP(r2): sba_unmap_sg+0xac/0x118 |
| [1274934.746891] Backtrace: |
| [1274934.746891] [<00000000402740cc>] dma_unmap_sg_attrs+0x6c/0x70 |
| [1274934.746891] [<000000004074d6bc>] scsi_dma_unmap+0x54/0x60 |
| [1274934.746891] [<00000000407a3488>] mptscsih_io_done+0x150/0xd70 |
| [1274934.746891] [<0000000040798600>] mpt_interrupt+0x168/0xa68 |
| [1274934.746891] [<0000000040255a48>] __handle_irq_event_percpu+0xc8/0x278 |
| [1274934.746891] [<0000000040255c34>] handle_irq_event_percpu+0x3c/0xd8 |
| [1274934.746891] [<000000004025ecb4>] handle_percpu_irq+0xb4/0xf0 |
| [1274934.746891] [<00000000402548e0>] generic_handle_irq+0x50/0x70 |
| [1274934.746891] [<000000004019a254>] call_on_stack+0x18/0x24 |
| [1274934.746891] |
| [1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?) |
| |
| The bug is caused by overrunning the sglist and incorrectly testing |
| sg_dma_len(sglist) before nents. Normally this doesn't cause a crash, |
| but in this case sglist crossed a page boundary. This occurs in the |
| following code: |
| |
| while (sg_dma_len(sglist) && nents--) { |
| |
| The fix is simply to test nents first and move the decrement of nents |
| into the loop. |
| |
| The Linux kernel CVE team has assigned CVE-2022-48795 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.9.303 with commit f23f0444ead4d941165aa82ce2fcbb997dc00e97 |
| Fixed in 4.14.268 with commit de75676ee99bf9f25b1124ff301b3f7b8ba597d4 |
| Fixed in 4.19.231 with commit 867e50231c7605547d9334904d70a181f39f2d9e |
| Fixed in 5.4.181 with commit efccc9b0c7e28d0eb7918a236e59f60dc23db4c3 |
| Fixed in 5.10.102 with commit f8f519d7df66c334b5e08f896ac70ee3b53add3b |
| Fixed in 5.15.25 with commit 8c8e949ae81e7f5ab58f9f9f8e9b573b93173dd2 |
| Fixed in 5.16.11 with commit e40ae3133ed87d6d526f3c8fc6a5f9a2d72dcdbf |
| Fixed in 5.17 with commit b7d6f44a0fa716a82969725516dc0b16bc7cd514 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-48795 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/parisc/sba_iommu.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/f23f0444ead4d941165aa82ce2fcbb997dc00e97 |
| https://git.kernel.org/stable/c/de75676ee99bf9f25b1124ff301b3f7b8ba597d4 |
| https://git.kernel.org/stable/c/867e50231c7605547d9334904d70a181f39f2d9e |
| https://git.kernel.org/stable/c/efccc9b0c7e28d0eb7918a236e59f60dc23db4c3 |
| https://git.kernel.org/stable/c/f8f519d7df66c334b5e08f896ac70ee3b53add3b |
| https://git.kernel.org/stable/c/8c8e949ae81e7f5ab58f9f9f8e9b573b93173dd2 |
| https://git.kernel.org/stable/c/e40ae3133ed87d6d526f3c8fc6a5f9a2d72dcdbf |
| https://git.kernel.org/stable/c/b7d6f44a0fa716a82969725516dc0b16bc7cd514 |
