| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-36928: s390/qeth: Fix kernel panic after setting hsuid |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| s390/qeth: Fix kernel panic after setting hsuid |
| |
| Symptom: |
| When the hsuid attribute is set for the first time on an IQD Layer3 |
| device while the corresponding network interface is already UP, |
| the kernel will try to execute a napi function pointer that is NULL. |
| |
| Example: |
| --------------------------------------------------------------------------- |
| [ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP |
| [ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 |
| nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de |
| s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod |
| qdio ccwgroup pkey zcrypt |
| [ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1 |
| [ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR) |
| [ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2) |
| [ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 |
| [ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000 |
| [ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80 |
| [ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8 |
| [ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68 |
| [ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal |
| >0000000000000002: 0000 illegal |
| 0000000000000004: 0000 illegal |
| 0000000000000006: 0000 illegal |
| 0000000000000008: 0000 illegal |
| 000000000000000a: 0000 illegal |
| 000000000000000c: 0000 illegal |
| 000000000000000e: 0000 illegal |
| [ 2057.572800] Call Trace: |
| [ 2057.572801] ([<00000000ec639700>] 0xec639700) |
| [ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398 |
| [ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0 |
| [ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58 |
| [ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60) |
| [ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98 |
| [ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70 |
| [ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv] |
| [ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv] |
| [ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv] |
| [ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8 |
| [ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348 |
| [ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8 |
| [ 2057.572843] Last Breaking-Event-Address: |
| [ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8 |
| [ 2057.572846] |
| [ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt |
| ------------------------------------------------------------------------------------------- |
| |
| Analysis: |
| There is one napi structure per out_q: card->qdio.out_qs[i].napi |
| The napi.poll functions are set during qeth_open(). |
| |
| Since |
| commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") |
| qeth_set_offline()/qeth_set_online() no longer call dev_close()/ |
| dev_open(). So if qeth_free_qdio_queues() cleared |
| card->qdio.out_qs[i].napi.poll while the network interface was UP and the |
| card was offline, they are not set again. |
| |
| Reproduction: |
| chzdev -e $devno layer2=0 |
| ip link set dev $network_interface up |
| echo 0 > /sys/bus/ccwgroup/devices/0.0.$devno/online |
| echo foo > /sys/bus/ccwgroup/devices/0.0.$devno/hsuid |
| echo 1 > /sys/bus/ccwgroup/devices/0.0.$devno/online |
| -> Crash (can be enforced e.g. by af_iucv connect(), ip link down/up, ...) |
| |
| Note that a Completion Queue (CQ) is only enabled or disabled, when hsuid |
| is set for the first time or when it is removed. |
| |
| Workarounds: |
| - Set hsuid before setting the device online for the first time |
| or |
| - Use chzdev -d $devno; chzdev $devno hsuid=xxx; chzdev -e $devno; |
| to set hsuid on an existing device. (this will remove and recreate the |
| network interface) |
| |
| Fix: |
| There is no need to free the output queues when a completion queue is |
| added or removed. |
| card->qdio.state now indicates whether the inbound buffer pool and the |
| outbound queues are allocated. |
| card->qdio.c_q indicates whether a CQ is allocated. |
| |
| The Linux kernel CVE team has assigned CVE-2024-36928 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.15.126 with commit 64e3affee2881bb22df7ce45dd1f1fd7990e382b and fixed in 5.15.159 with commit 8792b557eb50b986f2496156d486d0c7c85a1524 |
| Issue introduced in 6.1.45 with commit 86818409f989fee29c38528ed8fb085655603356 and fixed in 6.1.91 with commit 10cb803aff3b11fe0bd5f274fc1c231a43e88df6 |
| Issue introduced in 6.5 with commit 1cfef80d4c2b2c599189f36f36320b205d9447d9 and fixed in 6.6.31 with commit e28dd1e1bf3ebb52cdb877fb359e8978a51576e3 |
| Issue introduced in 6.5 with commit 1cfef80d4c2b2c599189f36f36320b205d9447d9 and fixed in 6.8.10 with commit eae0aec245712c52a3ce9c05575b541a9eef5282 |
| Issue introduced in 6.5 with commit 1cfef80d4c2b2c599189f36f36320b205d9447d9 and fixed in 6.9 with commit 8a2e4d37afb8500b276e5ee903dee06f50ab0494 |
| Issue introduced in 5.10.190 with commit c33d5a5c5b2c79326190885040f1643793c67b29 |
| Issue introduced in 6.4.10 with commit 29d6fe395087710280f8e11d4ae79569c4cb14b7 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-36928 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/s390/net/qeth_core_main.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524 |
| https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6 |
| https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3 |
| https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282 |
| https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494 |
