| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-50146: net/mlx5e: Don't call cleanup on profile rollback failure |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net/mlx5e: Don't call cleanup on profile rollback failure |
| |
| When profile rollback fails in mlx5e_netdev_change_profile, the netdev |
| profile var is left set to NULL. Avoid a crash when unloading the driver |
| by not calling profile->cleanup in such a case. |
| |
| This was encountered while testing, with the original trigger that |
| the wq rescuer thread creation got interrupted (presumably due to |
| Ctrl+C-ing modprobe), which gets converted to ENOMEM (-12) by |
| mlx5e_priv_init, the profile rollback also fails for the same reason |
| (signal still active) so the profile is left as NULL, leading to a crash |
| later in _mlx5e_remove. |
| |
| [ 732.473932] mlx5_core 0000:08:00.1: E-Switch: Unload vfs: mode(OFFLOADS), nvfs(2), necvfs(0), active vports(2) |
| [ 734.525513] workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR |
| [ 734.557372] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12 |
| [ 734.559187] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: new profile init failed, -12 |
| [ 734.560153] workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR |
| [ 734.589378] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12 |
| [ 734.591136] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 |
| [ 745.537492] BUG: kernel NULL pointer dereference, address: 0000000000000008 |
| [ 745.538222] #PF: supervisor read access in kernel mode |
| <snipped> |
| [ 745.551290] Call Trace: |
| [ 745.551590] <TASK> |
| [ 745.551866] ? __die+0x20/0x60 |
| [ 745.552218] ? page_fault_oops+0x150/0x400 |
| [ 745.555307] ? exc_page_fault+0x79/0x240 |
| [ 745.555729] ? asm_exc_page_fault+0x22/0x30 |
| [ 745.556166] ? mlx5e_remove+0x6b/0xb0 [mlx5_core] |
| [ 745.556698] auxiliary_bus_remove+0x18/0x30 |
| [ 745.557134] device_release_driver_internal+0x1df/0x240 |
| [ 745.557654] bus_remove_device+0xd7/0x140 |
| [ 745.558075] device_del+0x15b/0x3c0 |
| [ 745.558456] mlx5_rescan_drivers_locked.part.0+0xb1/0x2f0 [mlx5_core] |
| [ 745.559112] mlx5_unregister_device+0x34/0x50 [mlx5_core] |
| [ 745.559686] mlx5_uninit_one+0x46/0xf0 [mlx5_core] |
| [ 745.560203] remove_one+0x4e/0xd0 [mlx5_core] |
| [ 745.560694] pci_device_remove+0x39/0xa0 |
| [ 745.561112] device_release_driver_internal+0x1df/0x240 |
| [ 745.561631] driver_detach+0x47/0x90 |
| [ 745.562022] bus_remove_driver+0x84/0x100 |
| [ 745.562444] pci_unregister_driver+0x3b/0x90 |
| [ 745.562890] mlx5_cleanup+0xc/0x1b [mlx5_core] |
| [ 745.563415] __x64_sys_delete_module+0x14d/0x2f0 |
| [ 745.563886] ? kmem_cache_free+0x1b0/0x460 |
| [ 745.564313] ? lockdep_hardirqs_on_prepare+0xe2/0x190 |
| [ 745.564825] do_syscall_64+0x6d/0x140 |
| [ 745.565223] entry_SYSCALL_64_after_hwframe+0x4b/0x53 |
| [ 745.565725] RIP: 0033:0x7f1579b1288b |
| |
| The Linux kernel CVE team has assigned CVE-2024-50146 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.12 with commit 3ef14e463f6ed0218710f56b97e1a7d0448784d2 and fixed in 6.1.123 with commit db84cb4c8c565e6d4de84b23c2818b63991adfdd |
| Issue introduced in 5.12 with commit 3ef14e463f6ed0218710f56b97e1a7d0448784d2 and fixed in 6.6.80 with commit d6fe973c8873c998734a050f366b28facc03d32a |
| Issue introduced in 5.12 with commit 3ef14e463f6ed0218710f56b97e1a7d0448784d2 and fixed in 6.11.6 with commit 3955b77494c3c7d14873b1db67e7e00c46a714db |
| Issue introduced in 5.12 with commit 3ef14e463f6ed0218710f56b97e1a7d0448784d2 and fixed in 6.12 with commit 4dbc1d1a9f39c3711ad2a40addca04d07d9ab5d0 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-50146 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/mellanox/mlx5/core/en_main.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/db84cb4c8c565e6d4de84b23c2818b63991adfdd |
| https://git.kernel.org/stable/c/d6fe973c8873c998734a050f366b28facc03d32a |
| https://git.kernel.org/stable/c/3955b77494c3c7d14873b1db67e7e00c46a714db |
| https://git.kernel.org/stable/c/4dbc1d1a9f39c3711ad2a40addca04d07d9ab5d0 |
