From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1AEFC2D048 for ; Mon, 18 Mar 2024 10:08:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710756518; cv=none; b=SajRgp+FR6eXTyVLqvnWMdBntFFIxAiyrK79AG4vVMM+FCwIE/a5RVWSamhgHmzo472SUFlag9uD5phe1sdIyy/hx1YOCqLy6G1VtSdAuQRM35rDMkt6h/t2tKBmBl7KJA9Gy4YginyvgGYACRkKQPjMbWbOSTkTy+CXbj58MrY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710756518; c=relaxed/simple; bh=pkGR7kgfNyBkW027tknaoh8bSa9ki1zH2qYUUdhivsg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=r0gEShIOcxFxTFsJoV1j2WJWcWOKQm8A7hxHiJfvlL6QK4Z0OaAkcLs4bMJdRtVWPAlDLsBOjM2b9Amze9T5G5wJO7GHivnYRdEhmzxXpv1/4Rk6n18/7X5Z5nOefBFM34kEvm6ClCN++SBlp/NVMi7ThHHchxbt1IFp+uPmZe8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VBf144Zy; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VBf144Zy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 018F5C433C7; Mon, 18 Mar 2024 10:08:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1710756517; bh=pkGR7kgfNyBkW027tknaoh8bSa9ki1zH2qYUUdhivsg=; h=From:To:Cc:Subject:Date:Reply-to:From; b=VBf144ZyVb1E5wenKhsgcAPa6u5YNYnSGSjktr79dK/BlVsLDT+sfGCbV2/zPRhqU GmqJRCjKX4YKqFbcfEEN/DJ9QW0hwcHkmH3NAmQbHnUH9jvydFrJDKalujdIGPipx0 a2JAMGEUC/Ba7QXv/A15x+xb6Q/8JhCGdJeDVhGeCg1iy8BH+oN0rZwi3J5f1TyZ5U 9Vi/ZCZuX9Ta2IguduoRT+dtY8/nCDLwj3IIXHxGjWJoQSxxurdva/GDiQ0tdgucuT 9RRG+GeriNpr9uPV2h0Emq69BMVLy2HbYZFTUFSu+05bcl759WRfhB7lUu2iPJNvZC n5cRH5/+ryJOg== From: Lee Jones To: linux-cve-announce@vger.kernel.org Cc: Lee Jones Subject: CVE-2023-52613: drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment Date: Mon, 18 Mar 2024 10:08:03 +0000 Message-ID: <20240318100758.2828621-13-lee@kernel.org> X-Mailer: git-send-email 2.44.0.291.gc1ea87d7ee-goog Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5992; i=lee@kernel.org; h=from:subject; bh=pkGR7kgfNyBkW027tknaoh8bSa9ki1zH2qYUUdhivsg=; b=owEBbQKS/ZANAwAKAVGvii+H/HdhAcsmYgBl+BJ/I+Ju7kEImA33+KIj5jJ9iAxGDm/5zL9zP yR+YkVBc4mJAjMEAAEKAB0WIQR2tsk1o74gmpTwh0hRr4ovh/x3YQUCZfgSfwAKCRBRr4ovh/x3 YVL9D/wL+eVVyKjLGYyY2eqyV3a7ap8vUWYc30NtenHA7ozz69zdHTOQLsDNMx8WUXgeE+txp0Z gO5H+msvdtaCvfyaJ432I3mh5WqSQNd/R7sV4itlLA7vNCYHFv1WkRSj15HVAba4xAsQy6pzc22 9Q0QhoNUeyI92y7gphO3UQF6Ih0dYJMglVXZiU8FMlBLo1dWkhNXdhgeqH5hVdaa4sCD/5FKXzp 6+X5+FsTUpnEe+NzeAvK5yiHrFSjL88fIgHzswHS9STW4EyEd1NeeRXVgpc9c82404M3TFvHNEj HtBrVsvAF98MtONA6++76N+u/jTAht/QJssyDvWr2wYw5ETUYe2OHMt4z+p9PovTqGRftaItHtD AjkXH4ymUwItpRnmyF8bwZGCmupub+YHlnQiIq/OZ/Dp+A3RDk8qO8Oyyn4AVzsyLXUy+Cs8GdF sv5ONLIl+hpWmLtL8UQ+9Ek4p0qZ/81KK9QBwyAbeyNhicVlSaNxApHffttkfk1HsxqRybm/NjT G+GQU8dRshPxpxysIzQ2ybO67SxpvUj3MqkrhPMFqt7CqbEvL15jtwz+p16nQPrBRihAzx7usVV OjPOyk/7+KU29VkuN26ZXHFkfCM4Bfzo5a/NPa3u3WSQO/Nm1ORP6Ot5lsAMp9FZ7uT0LHK/1U4 AbLEbgkcIL77nnQ== X-Developer-Key: i=lee@kernel.org; a=openpgp; fpr=76B6C935A3BE209A94F0874851AF8A2F87FC7761 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment PTR_ERR() returns -ENODEV when thermal-zones are undefined, and we need -ENODEV as the right value for comparison. Otherwise, tz->type is NULL when thermal-zones is undefined, resulting in the following error: [ 12.290030] CPU 1 Unable to handle kernel paging request at virtual address fffffffffffffff1, era == 900000000355f410, ra == 90000000031579b8 [ 12.302877] Oops[#1]: [ 12.305190] CPU: 1 PID: 181 Comm: systemd-udevd Not tainted 6.6.0-rc7+ #5385 [ 12.312304] pc 900000000355f410 ra 90000000031579b8 tp 90000001069e8000 sp 90000001069eba10 [ 12.320739] a0 0000000000000000 a1 fffffffffffffff1 a2 0000000000000014 a3 0000000000000001 [ 12.329173] a4 90000001069eb990 a5 0000000000000001 a6 0000000000001001 a7 900000010003431c [ 12.337606] t0 fffffffffffffff1 t1 54567fd5da9b4fd4 t2 900000010614ec40 t3 00000000000dc901 [ 12.346041] t4 0000000000000000 t5 0000000000000004 t6 900000010614ee20 t7 900000000d00b790 [ 12.354472] t8 00000000000dc901 u0 54567fd5da9b4fd4 s9 900000000402ae10 s0 900000010614ec40 [ 12.362916] s1 90000000039fced0 s2 ffffffffffffffed s3 ffffffffffffffed s4 9000000003acc000 [ 12.362931] s5 0000000000000004 s6 fffffffffffff000 s7 0000000000000490 s8 90000001028b2ec8 [ 12.362938] ra: 90000000031579b8 thermal_add_hwmon_sysfs+0x258/0x300 [ 12.386411] ERA: 900000000355f410 strscpy+0xf0/0x160 [ 12.391626] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 12.397898] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 12.403678] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 12.409859] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) [ 12.415882] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 12.415907] BADV: fffffffffffffff1 [ 12.415911] PRID: 0014a000 (Loongson-64bit, Loongson-2K1000) [ 12.415917] Modules linked in: loongson2_thermal(+) vfat fat uio_pdrv_genirq uio fuse zram zsmalloc [ 12.415950] Process systemd-udevd (pid: 181, threadinfo=00000000358b9718, task=00000000ace72fe3) [ 12.415961] Stack : 0000000000000dc0 54567fd5da9b4fd4 900000000402ae10 9000000002df9358 [ 12.415982] ffffffffffffffed 0000000000000004 9000000107a10aa8 90000001002a3410 [ 12.415999] ffffffffffffffed ffffffffffffffed 9000000107a11268 9000000003157ab0 [ 12.416016] 9000000107a10aa8 ffffff80020fc0c8 90000001002a3410 ffffffffffffffed [ 12.416032] 0000000000000024 ffffff80020cc1e8 900000000402b2a0 9000000003acc000 [ 12.416048] 90000001002a3410 0000000000000000 ffffff80020f4030 90000001002a3410 [ 12.416065] 0000000000000000 9000000002df6808 90000001002a3410 0000000000000000 [ 12.416081] ffffff80020f4030 0000000000000000 90000001002a3410 9000000002df2ba8 [ 12.416097] 00000000000000b4 90000001002a34f4 90000001002a3410 0000000000000002 [ 12.416114] ffffff80020f4030 fffffffffffffff0 90000001002a3410 9000000002df2f30 [ 12.416131] ... [ 12.416138] Call Trace: [ 12.416142] [<900000000355f410>] strscpy+0xf0/0x160 [ 12.416167] [<90000000031579b8>] thermal_add_hwmon_sysfs+0x258/0x300 [ 12.416183] [<9000000003157ab0>] devm_thermal_add_hwmon_sysfs+0x50/0xe0 [ 12.416200] [] loongson2_thermal_probe+0x128/0x200 [loongson2_thermal] [ 12.416232] [<9000000002df6808>] platform_probe+0x68/0x140 [ 12.416249] [<9000000002df2ba8>] really_probe+0xc8/0x3c0 [ 12.416269] [<9000000002df2f30>] __driver_probe_device+0x90/0x180 [ 12.416286] [<9000000002df3058>] driver_probe_device+0x38/0x160 [ 12.416302] [<9000000002df33a8>] __driver_attach+0xa8/0x200 [ 12.416314] [<9000000002deffec>] bus_for_each_dev+0x8c/0x120 [ 12.416330] [<9000000002df198c>] bus_add_driver+0x10c/0x2a0 [ 12.416346] [<9000000002df46b4>] driver_register+0x74/0x160 [ 12.416358] [<90000000022201a4>] do_one_initcall+0x84/0x220 [ 12.416372] [<90000000022f3ab8>] do_init_module+0x58/0x2c0 [ 12.416386] [<90000000022f6538>] init_module_from_file+0x98/0x100 [ 12.416399] [<90000000022f67f0>] sys_finit_module+0x230/0x3c0 [ 12.416412] [<900000000358f7c8>] do_syscall+0x88/0xc0 [ 12.416431] [<900000000222137c>] handle_syscall+0xbc/0x158 The Linux kernel CVE team has assigned CVE-2023-52613 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6 with commit e7e3a7c35791 and fixed in 6.6.14 with commit 70481755ed77 Issue introduced in 6.6 with commit e7e3a7c35791 and fixed in 6.7.2 with commit 6010a9fc14eb Issue introduced in 6.6 with commit e7e3a7c35791 and fixed in 6.8 with commit 15ef92e9c411 Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-52613 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/thermal/loongson2_thermal.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/70481755ed77400e783200e2d022e5fea16060ce https://git.kernel.org/stable/c/6010a9fc14eb1feab5cafd84422001134fe8ec58 https://git.kernel.org/stable/c/15ef92e9c41124ee9d88b01208364f3fe1f45f84