From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BADF915667D for ; Thu, 27 Feb 2025 02:08:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740622121; cv=none; b=TaNIFH2zjwZ5my3Vk8PY9G//7Rwy4Ao+B7krxMOVv3B4YmZMouRkzwOzXR74uvaUFE8iJXiuYm1SHGUJm5BRgTlknxhUGyawiY6HNZEMfTqG2sgINepa9Zo3VgumMvoBXc4MGLpNHFC8GLx+LXPHBzi5N7zCa6K0CcP2Pk3ExGw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740622121; c=relaxed/simple; bh=oeC15YBCnMpx32MKXb/yidfcRjeEWzaOyemOQg+MBdQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Xn23vhy49yQv6waviWIZ3IENatFnx0HctlDAOZO11h9zKu8Hka5cTpalQRQ6jIEgVzYui5aeM4NnLNqwutlqFrKSrI3z0BVq8mHtjm409l/NY0E8+gVpXLmwxc6ig6WnnHzHTsEYM9dC+aeL6IRSDYgKImjLGoCx0Fh5cnI/vv4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=G171heoG; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="G171heoG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87F6DC4CED6; Thu, 27 Feb 2025 02:08:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740622121; bh=oeC15YBCnMpx32MKXb/yidfcRjeEWzaOyemOQg+MBdQ=; h=From:To:Cc:Subject:Date:Reply-to:From; b=G171heoG9/vb5Wf1Vx5jnuVoB+7yb4euBt/Kq4rQQi+qe4Vey6v/SnCS4VMT8O7ha vbOvwh73RPkmR+nwa8i+xK2H9PdWqC5gXFC3iIXNndZPmWT1znqMLqIHgpvHxV16Pd NPoXny7eJGjx9YQbH7+oGn/mMPAAPJme01LfCCbo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() Date: Wed, 26 Feb 2025 18:05:53 -0800 Message-ID: <2025022639-CVE-2024-57994-8dbd@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4870; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=oeC15YBCnMpx32MKXb/yidfcRjeEWzaOyemOQg+MBdQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7T5RM/S6UkcDfyfLqruruI9fVuWe8X7bkltAhs/Tzz 1KXnEnL7ohlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJLFdimF96e5bJavsDGhta D1gclGDqmaenvZphQZ9h52eOg9fFtoteWrbRcUKH5p0GcQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage. syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1] As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH. Rename helpers to better reflect they are safe against BH only. - ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh() - skb_array_resize_multiple() to skb_array_resize_multiple_bh() [1] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 The Linux kernel CVE team has assigned CVE-2024-57994 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6 with commit ff4e538c8c3e675a15e1e49509c55951832e0451 and fixed in 6.12.13 with commit 3257dac521d0ac6653108c755141dce634bb8ff2 Issue introduced in 6.6 with commit ff4e538c8c3e675a15e1e49509c55951832e0451 and fixed in 6.13.2 with commit e74801b7628dc52b17471aec729bc675479ddc73 Issue introduced in 6.6 with commit ff4e538c8c3e675a15e1e49509c55951832e0451 and fixed in 6.14-rc1 with commit a126061c80d5efb4baef4bcf346094139cd81df6 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-57994 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/tap.c drivers/net/tun.c include/linux/ptr_ring.h include/linux/skb_array.h net/sched/sch_generic.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3257dac521d0ac6653108c755141dce634bb8ff2 https://git.kernel.org/stable/c/e74801b7628dc52b17471aec729bc675479ddc73 https://git.kernel.org/stable/c/a126061c80d5efb4baef4bcf346094139cd81df6