cve/published/2022/CVE-2022-49605.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49605: igc: Reinstate IGC_REMOVED logic and implement it properly

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

igc: Reinstate IGC_REMOVED logic and implement it properly

The initially merged version of the igc driver code (via commit
146740f9abc4, "igc: Add support for PF") contained the following
IGC_REMOVED checks in the igc_rd32/wr32() MMIO accessors:

	u32 igc_rd32(struct igc_hw *hw, u32 reg)
	{
		u8 __iomem *hw_addr = READ_ONCE(hw->hw_addr);
		u32 value = 0;

		if (IGC_REMOVED(hw_addr))
			return ~value;

		value = readl(&hw_addr[reg]);

		/* reads should not return all F's */
		if (!(~value) && (!reg || !(~readl(hw_addr))))
			hw->hw_addr = NULL;

		return value;
	}

And:

	#define wr32(reg, val) \
	do { \
		u8 __iomem *hw_addr = READ_ONCE((hw)->hw_addr); \
		if (!IGC_REMOVED(hw_addr)) \
			writel((val), &hw_addr[(reg)]); \
	} while (0)

E.g. igb has similar checks in its MMIO accessors, and has a similar
macro E1000_REMOVED, which is implemented as follows:

	#define E1000_REMOVED(h) unlikely(!(h))

These checks serve to detect and take note of an 0xffffffff MMIO read
return from the device, which can be caused by a PCIe link flap or some
other kind of PCI bus error, and to avoid performing MMIO reads and
writes from that point onwards.

However, the IGC_REMOVED macro was not originally implemented:

	#ifndef IGC_REMOVED
	#define IGC_REMOVED(a) (0)
	#endif /* IGC_REMOVED */

This led to the IGC_REMOVED logic to be removed entirely in a
subsequent commit (commit 3c215fb18e70, "igc: remove IGC_REMOVED
function"), with the rationale that such checks matter only for
virtualization and that igc does not support virtualization -- but a
PCIe device can become detached even without virtualization being in
use, and without proper checks, a PCIe bus error affecting an igc
adapter will lead to various NULL pointer dereferences, as the first
access after the error will set hw->hw_addr to NULL, and subsequent
accesses will blindly dereference this now-NULL pointer.

This patch reinstates the IGC_REMOVED checks in igc_rd32/wr32(), and
implements IGC_REMOVED the way it is done for igb, by checking for the
unlikely() case of hw_addr being NULL.  This change prevents the oopses
seen when a PCIe link flap occurs on an igc adapter.

The Linux kernel CVE team has assigned CVE-2022-49605 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.20 with commit 146740f9abc4976e4f0af1aa302efee1c699d2e4 and fixed in 5.4.208 with commit 16cb6717f4f42487ef10583eb8bc98e7d1e33d65
	Issue introduced in 4.20 with commit 146740f9abc4976e4f0af1aa302efee1c699d2e4 and fixed in 5.10.134 with commit 77836dbe35382aaf8108489060c5c89530c77494
	Issue introduced in 4.20 with commit 146740f9abc4976e4f0af1aa302efee1c699d2e4 and fixed in 5.15.58 with commit e75b73081f1ec169518773626c2ff3950476660b
	Issue introduced in 4.20 with commit 146740f9abc4976e4f0af1aa302efee1c699d2e4 and fixed in 5.18.15 with commit 70965b6e5c03aa70cc754af1226b9f9cde0c4bf3
	Issue introduced in 4.20 with commit 146740f9abc4976e4f0af1aa302efee1c699d2e4 and fixed in 5.19 with commit 7c1ddcee5311f3315096217881d2dbe47cc683f9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49605
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/intel/igc/igc_main.c
	drivers/net/ethernet/intel/igc/igc_regs.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/16cb6717f4f42487ef10583eb8bc98e7d1e33d65
	https://git.kernel.org/stable/c/77836dbe35382aaf8108489060c5c89530c77494
	https://git.kernel.org/stable/c/e75b73081f1ec169518773626c2ff3950476660b
	https://git.kernel.org/stable/c/70965b6e5c03aa70cc754af1226b9f9cde0c4bf3
	https://git.kernel.org/stable/c/7c1ddcee5311f3315096217881d2dbe47cc683f9