| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-52780: net: mvneta: fix calls to page_pool_get_stats |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: mvneta: fix calls to page_pool_get_stats |
| |
| Calling page_pool_get_stats in the mvneta driver without checks |
| leads to kernel crashes. |
| First the page pool is only available if the bm is not used. |
| The page pool is also not allocated when the port is stopped. |
| It can also be not allocated in case of errors. |
| |
| The current implementation leads to the following crash calling |
| ethstats on a port that is down or when calling it at the wrong moment: |
| |
| ble to handle kernel NULL pointer dereference at virtual address 00000070 |
| [00000070] *pgd=00000000 |
| Internal error: Oops: 5 [#1] SMP ARM |
| Hardware name: Marvell Armada 380/385 (Device Tree) |
| PC is at page_pool_get_stats+0x18/0x1cc |
| LR is at mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] |
| pc : [<c0b413cc>] lr : [<bf0a98d8>] psr: a0000013 |
| sp : f1439d48 ip : f1439dc0 fp : 0000001d |
| r10: 00000100 r9 : c4816b80 r8 : f0d75150 |
| r7 : bf0b400c r6 : c238f000 r5 : 00000000 r4 : f1439d68 |
| r3 : c2091040 r2 : ffffffd8 r1 : f1439d68 r0 : 00000000 |
| Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none |
| Control: 10c5387d Table: 066b004a DAC: 00000051 |
| Register r0 information: NULL pointer |
| Register r1 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 |
| Register r2 information: non-paged memory |
| Register r3 information: slab kmalloc-2k start c2091000 pointer offset 64 size 2048 |
| Register r4 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 |
| Register r5 information: NULL pointer |
| Register r6 information: slab kmalloc-cg-4k start c238f000 pointer offset 0 size 4096 |
| Register r7 information: 15-page vmalloc region starting at 0xbf0a8000 allocated at load_module+0xa30/0x219c |
| Register r8 information: 1-page vmalloc region starting at 0xf0d75000 allocated at ethtool_get_stats+0x138/0x208 |
| Register r9 information: slab task_struct start c4816b80 pointer offset 0 |
| Register r10 information: non-paged memory |
| Register r11 information: non-paged memory |
| Register r12 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 |
| Process snmpd (pid: 733, stack limit = 0x38de3a88) |
| Stack: (0xf1439d48 to 0xf143a000) |
| 9d40: 000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80 |
| 9d60: 00000100 bf0a98d8 00000000 00000000 00000000 00000000 00000000 00000000 |
| 9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 |
| 9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 |
| 9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8 |
| 9de0: 0000001d 00000035 c2212094 5335509c c4816b80 c238f000 c5ad6e00 01067f50 |
| 9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d |
| 9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000 |
| 9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 |
| 9e60: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000 |
| 9e80: 00000000 00000000 00000000 5335509c c1b0be80 f1439ee4 00008946 c1b0be80 |
| 9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8 |
| 9ec0: c1b0be80 00000051 0000000b c68ca480 c7172d00 c0ad8ff0 f1439ee3 cf600e40 |
| 9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000 |
| 9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0 |
| 9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6d77ae0 c030caf0 |
| 9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014 |
| 9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c |
| 9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036 |
| 9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 |
| 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 |
| 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 40000030 0000000b 00000000 00000000 |
| page_pool_get_stats from mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] |
| mvneta_ethtool_get_stats [mvneta] from ethtool_get_stats+0x154/0x208 |
| ethtool_get_stats from dev_ethtool+0xf48/0x2480 |
| dev_ethtool from dev_ioctl+0x538/0x63c |
| dev_ioctl from sock_ioctl+0x49c/0x53c |
| sock_ioctl from sys_ioctl+0x134/0xbd8 |
| sys_ioctl from ret_fast_syscall+0x0/0x1c |
| Exception stack(0xf1439fa8 to 0xf1439ff0) |
| 9fa0: 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 |
| 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 |
| 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 |
| Code: e28dd004 e1a05000 e2514000 0a00006a (e5902070) |
| |
| This commit adds the proper checks before calling page_pool_get_stats. |
| |
| The Linux kernel CVE team has assigned CVE-2023-52780 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.19 with commit b3fc79225f055af7ef48b47a90752c31cc062e6e and fixed in 6.1.64 with commit 00768b3e90e648227eaa959d9d279f5e32823df1 |
| Issue introduced in 5.19 with commit b3fc79225f055af7ef48b47a90752c31cc062e6e and fixed in 6.5.13 with commit 230dc06e2495487d88b3410da055bb618febb19b |
| Issue introduced in 5.19 with commit b3fc79225f055af7ef48b47a90752c31cc062e6e and fixed in 6.6.3 with commit 2b0e99072654edd601d05c0061a20337af5008ba |
| Issue introduced in 5.19 with commit b3fc79225f055af7ef48b47a90752c31cc062e6e and fixed in 6.7 with commit ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-52780 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/marvell/mvneta.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/00768b3e90e648227eaa959d9d279f5e32823df1 |
| https://git.kernel.org/stable/c/230dc06e2495487d88b3410da055bb618febb19b |
| https://git.kernel.org/stable/c/2b0e99072654edd601d05c0061a20337af5008ba |
| https://git.kernel.org/stable/c/ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed |
