| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-56656: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips |
| |
| The 5760X (P7) chip's HW GRO/LRO interface is very similar to that of |
| the previous generation (5750X or P5). However, the aggregation ID |
| fields in the completion structures on P7 have been redefined from |
| 16 bits to 12 bits. The freed up 4 bits are redefined for part of the |
| metadata such as the VLAN ID. The aggregation ID mask was not modified |
| when adding support for P7 chips. Including the extra 4 bits for the |
| aggregation ID can potentially cause the driver to store or fetch the |
| packet header of GRO/LRO packets in the wrong TPA buffer. It may hit |
| the BUG() condition in __skb_pull() because the SKB contains no valid |
| packet header: |
| |
| kernel BUG at include/linux/skbuff.h:2766! |
| Oops: invalid opcode: 0000 1 PREEMPT SMP NOPTI |
| CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: loaded Tainted: G OE 6.12.0-rc2+ #7 |
| Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE |
| Hardware name: Dell Inc. PowerEdge R760/0VRV9X, BIOS 1.0.1 12/27/2022 |
| RIP: 0010:eth_type_trans+0xda/0x140 |
| Code: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 d0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb a5 <0f> 0b b8 00 01 00 00 eb 9c 48 85 ff 74 eb 31 f6 b9 02 00 00 00 48 |
| RSP: 0018:ff615003803fcc28 EFLAGS: 00010283 |
| RAX: 00000000000022d2 RBX: 0000000000000003 RCX: ff2e8c25da334040 |
| RDX: 0000000000000040 RSI: ff2e8c25c1ce8000 RDI: ff2e8c25869f9000 |
| RBP: ff2e8c258c31c000 R08: ff2e8c25da334000 R09: 0000000000000001 |
| R10: ff2e8c25da3342c0 R11: ff2e8c25c1ce89c0 R12: ff2e8c258e0990b0 |
| R13: ff2e8c25bb120000 R14: ff2e8c25c1ce89c0 R15: ff2e8c25869f9000 |
| FS: 0000000000000000(0000) GS:ff2e8c34be300000(0000) knlGS:0000000000000000 |
| CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| CR2: 000055f05317e4c8 CR3: 000000108bac6006 CR4: 0000000000773ef0 |
| DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 |
| PKRU: 55555554 |
| Call Trace: |
| <IRQ> |
| ? die+0x33/0x90 |
| ? do_trap+0xd9/0x100 |
| ? eth_type_trans+0xda/0x140 |
| ? do_error_trap+0x65/0x80 |
| ? eth_type_trans+0xda/0x140 |
| ? exc_invalid_op+0x4e/0x70 |
| ? eth_type_trans+0xda/0x140 |
| ? asm_exc_invalid_op+0x16/0x20 |
| ? eth_type_trans+0xda/0x140 |
| bnxt_tpa_end+0x10b/0x6b0 [bnxt_en] |
| ? bnxt_tpa_start+0x195/0x320 [bnxt_en] |
| bnxt_rx_pkt+0x902/0xd90 [bnxt_en] |
| ? __bnxt_tx_int.constprop.0+0x89/0x300 [bnxt_en] |
| ? kmem_cache_free+0x343/0x440 |
| ? __bnxt_tx_int.constprop.0+0x24f/0x300 [bnxt_en] |
| __bnxt_poll_work+0x193/0x370 [bnxt_en] |
| bnxt_poll_p5+0x9a/0x300 [bnxt_en] |
| ? try_to_wake_up+0x209/0x670 |
| __napi_poll+0x29/0x1b0 |
| |
| Fix it by redefining the aggregation ID mask for P5_PLUS chips to be |
| 12 bits. This will work because the maximum aggregation ID is less |
| than 4096 on all P5_PLUS chips. |
| |
| The Linux kernel CVE team has assigned CVE-2024-56656 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.8 with commit 13d2d3d381ee9844f89bd436ab0f44204660027e and fixed in 6.12.6 with commit fe9274027697c69c1430dc7ee568f82b331ef972 |
| Issue introduced in 6.8 with commit 13d2d3d381ee9844f89bd436ab0f44204660027e and fixed in 6.13 with commit 24c6843b7393ebc80962b59d7ae71af91bf0dcc1 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-56656 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/broadcom/bnxt/bnxt.h |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/fe9274027697c69c1430dc7ee568f82b331ef972 |
| https://git.kernel.org/stable/c/24c6843b7393ebc80962b59d7ae71af91bf0dcc1 |
