cve/published/2025/CVE-2025-21804.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2025-21804: PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()

The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region()
macro to request a needed resource. A string variable that lives on the
stack is then used to store a dynamically computed resource name, which
is then passed on as one of the macro arguments. This can lead to
undefined behavior.

Depending on the current contents of the memory, the manifestations of
errors may vary. One possible output may be as follows:

  $ cat /proc/iomem
  30000000-37ffffff :
  38000000-3fffffff :

Sometimes, garbage may appear after the colon.

In very rare cases, if no NULL-terminator is found in memory, the system
might crash because the string iterator will overrun which can lead to
access of unmapped memory above the stack.

Thus, fix this by replacing outbound_name with the name of the previously
requested resource. With the changes applied, the output will be as
follows:

  $ cat /proc/iomem
  30000000-37ffffff : memory2
  38000000-3fffffff : memory3

[kwilczynski: commit log]

The Linux kernel CVE team has assigned CVE-2025-21804 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.8 with commit 2a6d0d63d99956a66f6605832f11755d74a41951 and fixed in 5.10.235 with commit 7a47e14c5fb0b6dba7073be7b0119fb8fe864e01
	Issue introduced in 5.8 with commit 2a6d0d63d99956a66f6605832f11755d74a41951 and fixed in 5.15.179 with commit 6987e021b64cbb49981d140bb72d9d1466f191c4
	Issue introduced in 5.8 with commit 2a6d0d63d99956a66f6605832f11755d74a41951 and fixed in 6.1.129 with commit 24576899c49509c0d533bcf569139f691d8f7af7
	Issue introduced in 5.8 with commit 2a6d0d63d99956a66f6605832f11755d74a41951 and fixed in 6.6.76 with commit 2c54b9fca1755e80a343ccfde0652dc5ea4744b2
	Issue introduced in 5.8 with commit 2a6d0d63d99956a66f6605832f11755d74a41951 and fixed in 6.12.13 with commit 9ff46b0bfeb6e0724a4ace015aa7a0b887cdb7c1
	Issue introduced in 5.8 with commit 2a6d0d63d99956a66f6605832f11755d74a41951 and fixed in 6.13.2 with commit 44708208c2a4b828a57a2abe7799c9d3962e7eaa
	Issue introduced in 5.8 with commit 2a6d0d63d99956a66f6605832f11755d74a41951 and fixed in 6.14 with commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21804
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/pci/controller/pcie-rcar-ep.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7a47e14c5fb0b6dba7073be7b0119fb8fe864e01
	https://git.kernel.org/stable/c/6987e021b64cbb49981d140bb72d9d1466f191c4
	https://git.kernel.org/stable/c/24576899c49509c0d533bcf569139f691d8f7af7
	https://git.kernel.org/stable/c/2c54b9fca1755e80a343ccfde0652dc5ea4744b2
	https://git.kernel.org/stable/c/9ff46b0bfeb6e0724a4ace015aa7a0b887cdb7c1
	https://git.kernel.org/stable/c/44708208c2a4b828a57a2abe7799c9d3962e7eaa
	https://git.kernel.org/stable/c/2d2da5a4c1b4509f6f7e5a8db015cd420144beb4