| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-26796: drivers: perf: ctr_get_width function for legacy is not defined |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drivers: perf: ctr_get_width function for legacy is not defined |
| |
| With parameters CONFIG_RISCV_PMU_LEGACY=y and CONFIG_RISCV_PMU_SBI=n |
| linux kernel crashes when you try perf record: |
| |
| $ perf record ls |
| [ 46.749286] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 |
| [ 46.750199] Oops [#1] |
| [ 46.750342] Modules linked in: |
| [ 46.750608] CPU: 0 PID: 107 Comm: perf-exec Not tainted 6.6.0 #2 |
| [ 46.750906] Hardware name: riscv-virtio,qemu (DT) |
| [ 46.751184] epc : 0x0 |
| [ 46.751430] ra : arch_perf_update_userpage+0x54/0x13e |
| [ 46.751680] epc : 0000000000000000 ra : ffffffff8072ee52 sp : ff2000000022b8f0 |
| [ 46.751958] gp : ffffffff81505988 tp : ff6000000290d400 t0 : ff2000000022b9c0 |
| [ 46.752229] t1 : 0000000000000001 t2 : 0000000000000003 s0 : ff2000000022b930 |
| [ 46.752451] s1 : ff600000028fb000 a0 : 0000000000000000 a1 : ff600000028fb000 |
| [ 46.752673] a2 : 0000000ae2751268 a3 : 00000000004fb708 a4 : 0000000000000004 |
| [ 46.752895] a5 : 0000000000000000 a6 : 000000000017ffe3 a7 : 00000000000000d2 |
| [ 46.753117] s2 : ff600000028fb000 s3 : 0000000ae2751268 s4 : 0000000000000000 |
| [ 46.753338] s5 : ffffffff8153e290 s6 : ff600000863b9000 s7 : ff60000002961078 |
| [ 46.753562] s8 : ff60000002961048 s9 : ff60000002961058 s10: 0000000000000001 |
| [ 46.753783] s11: 0000000000000018 t3 : ffffffffffffffff t4 : ffffffffffffffff |
| [ 46.754005] t5 : ff6000000292270c t6 : ff2000000022bb30 |
| [ 46.754179] status: 0000000200000100 badaddr: 0000000000000000 cause: 000000000000000c |
| [ 46.754653] Code: Unable to access instruction at 0xffffffffffffffec. |
| [ 46.754939] ---[ end trace 0000000000000000 ]--- |
| [ 46.755131] note: perf-exec[107] exited with irqs disabled |
| [ 46.755546] note: perf-exec[107] exited with preempt_count 4 |
| |
| This happens because in the legacy case the ctr_get_width function was not |
| defined, but it is used in arch_perf_update_userpage. |
| |
| Also remove extra check in riscv_pmu_ctr_get_width_mask |
| |
| The Linux kernel CVE team has assigned CVE-2024-26796 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.6 with commit cc4c07c89aada16229084eeb93895c95b7eabaa3 and fixed in 6.6.21 with commit e0d17ee872cf8d0f51cc561329b8e1a0aa792bbb |
| Issue introduced in 6.6 with commit cc4c07c89aada16229084eeb93895c95b7eabaa3 and fixed in 6.7.9 with commit e4f50e85de5a6b21dfdc0d7ca435eba4f62935c3 |
| Issue introduced in 6.6 with commit cc4c07c89aada16229084eeb93895c95b7eabaa3 and fixed in 6.8 with commit 682dc133f83e0194796e6ea72eb642df1c03dfbe |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-26796 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/perf/riscv_pmu.c |
| drivers/perf/riscv_pmu_legacy.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/e0d17ee872cf8d0f51cc561329b8e1a0aa792bbb |
| https://git.kernel.org/stable/c/e4f50e85de5a6b21dfdc0d7ca435eba4f62935c3 |
| https://git.kernel.org/stable/c/682dc133f83e0194796e6ea72eb642df1c03dfbe |
