| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-48803: phy: ti: Fix missing sentinel for clk_div_table |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| phy: ti: Fix missing sentinel for clk_div_table |
| |
| _get_table_maxdiv() tries to access "clk_div_table" array out of bound |
| defined in phy-j721e-wiz.c. Add a sentinel entry to prevent |
| the following global-out-of-bounds error reported by enabling KASAN. |
| |
| [ 9.552392] BUG: KASAN: global-out-of-bounds in _get_maxdiv+0xc0/0x148 |
| [ 9.558948] Read of size 4 at addr ffff8000095b25a4 by task kworker/u4:1/38 |
| [ 9.565926] |
| [ 9.567441] CPU: 1 PID: 38 Comm: kworker/u4:1 Not tainted 5.16.0-116492-gdaadb3bd0e8d-dirty #360 |
| [ 9.576242] Hardware name: Texas Instruments J721e EVM (DT) |
| [ 9.581832] Workqueue: events_unbound deferred_probe_work_func |
| [ 9.587708] Call trace: |
| [ 9.590174] dump_backtrace+0x20c/0x218 |
| [ 9.594038] show_stack+0x18/0x68 |
| [ 9.597375] dump_stack_lvl+0x9c/0xd8 |
| [ 9.601062] print_address_description.constprop.0+0x78/0x334 |
| [ 9.606830] kasan_report+0x1f0/0x260 |
| [ 9.610517] __asan_load4+0x9c/0xd8 |
| [ 9.614030] _get_maxdiv+0xc0/0x148 |
| [ 9.617540] divider_determine_rate+0x88/0x488 |
| [ 9.622005] divider_round_rate_parent+0xc8/0x124 |
| [ 9.626729] wiz_clk_div_round_rate+0x54/0x68 |
| [ 9.631113] clk_core_determine_round_nolock+0x124/0x158 |
| [ 9.636448] clk_core_round_rate_nolock+0x68/0x138 |
| [ 9.641260] clk_core_set_rate_nolock+0x268/0x3a8 |
| [ 9.645987] clk_set_rate+0x50/0xa8 |
| [ 9.649499] cdns_sierra_phy_init+0x88/0x248 |
| [ 9.653794] phy_init+0x98/0x108 |
| [ 9.657046] cdns_pcie_enable_phy+0xa0/0x170 |
| [ 9.661340] cdns_pcie_init_phy+0x250/0x2b0 |
| [ 9.665546] j721e_pcie_probe+0x4b8/0x798 |
| [ 9.669579] platform_probe+0x8c/0x108 |
| [ 9.673350] really_probe+0x114/0x630 |
| [ 9.677037] __driver_probe_device+0x18c/0x220 |
| [ 9.681505] driver_probe_device+0xac/0x150 |
| [ 9.685712] __device_attach_driver+0xec/0x170 |
| [ 9.690178] bus_for_each_drv+0xf0/0x158 |
| [ 9.694124] __device_attach+0x184/0x210 |
| [ 9.698070] device_initial_probe+0x14/0x20 |
| [ 9.702277] bus_probe_device+0xec/0x100 |
| [ 9.706223] deferred_probe_work_func+0x124/0x180 |
| [ 9.710951] process_one_work+0x4b0/0xbc0 |
| [ 9.714983] worker_thread+0x74/0x5d0 |
| [ 9.718668] kthread+0x214/0x230 |
| [ 9.721919] ret_from_fork+0x10/0x20 |
| [ 9.725520] |
| [ 9.727032] The buggy address belongs to the variable: |
| [ 9.732183] clk_div_table+0x24/0x440 |
| |
| The Linux kernel CVE team has assigned CVE-2022-48803 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.6 with commit 091876cc355d6739e393efa4b3d07f451a6a035c and fixed in 5.10.101 with commit 3c75d1017cb362b6a4e0935746ef5da28250919f |
| Issue introduced in 5.6 with commit 091876cc355d6739e393efa4b3d07f451a6a035c and fixed in 5.15.24 with commit 7a360e546ad9e7c3fd53d6bb60348c660cd28f54 |
| Issue introduced in 5.6 with commit 091876cc355d6739e393efa4b3d07f451a6a035c and fixed in 5.16.10 with commit 5b0c9569135a37348c1267c81e8b0274b21a86ed |
| Issue introduced in 5.6 with commit 091876cc355d6739e393efa4b3d07f451a6a035c and fixed in 5.17 with commit 6d1e6bcb31663ee83aaea1f171f3dbfe95dd4a69 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-48803 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/phy/ti/phy-j721e-wiz.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/3c75d1017cb362b6a4e0935746ef5da28250919f |
| https://git.kernel.org/stable/c/7a360e546ad9e7c3fd53d6bb60348c660cd28f54 |
| https://git.kernel.org/stable/c/5b0c9569135a37348c1267c81e8b0274b21a86ed |
| https://git.kernel.org/stable/c/6d1e6bcb31663ee83aaea1f171f3dbfe95dd4a69 |
