From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0F378216618 for ; Wed, 26 Feb 2025 02:14:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536071; cv=none; b=LqqqHm5kluCJKq2Om/FzzRY/GV2bTDypEed2ah8WzGqfxEOXecLTuQpkn+cWtdL8FanUukA+Z/lFGgypPLNOtypxtTnEGqRA2WJwXZYZvHz/rwmKmB9p0YN/DVKHE8tt4bEdeUSS2i+d8NWfwm4gzmXteAcGfRe4zL3JyLA3EoQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536071; c=relaxed/simple; bh=m1JGwFkaqSHL/yaYuWvK3npS/OCOm9NYXltq487HMm4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=p2ZiE21YueyE/t6hYYXRqXqQTTY5gY2gDVBkJQX2TqPw0J8uerC3u5yXoExROL4S9TPWyiXd/GF/DllB10vg595mpV0Ped1l1a4uQFmFpYniGPeVDIoGjjOBJKlpS12L+s20qnecYa01DuZYRSZ2+2xuh5X9vbUXV13Qhkf4wKs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zcoaCYxV; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="zcoaCYxV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9807C4CEDD; Wed, 26 Feb 2025 02:14:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536070; bh=m1JGwFkaqSHL/yaYuWvK3npS/OCOm9NYXltq487HMm4=; h=From:To:Cc:Subject:Date:Reply-to:From; b=zcoaCYxVy8GW/jxKjQYXDenprtUmF3dSZ8wXLwOsfpMC14Y7X/aNFtx2cdrWu4Bd8 CBxGcYjYKVE8XI4rOsTVJPsSgeUop5klJRly7813qWGJcGcLeHfVzADOYr4vYgfN+7 UMnPUVolTJShXwK5j/8TaibNcn46X6XbspL3pcXc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49452: dpaa2-eth: retrieve the virtual address before dma_unmap Date: Wed, 26 Feb 2025 03:12:06 +0100 Message-ID: <2025022659-CVE-2022-49452-a5fa@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3609; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=m1JGwFkaqSHL/yaYuWvK3npS/OCOm9NYXltq487HMm4=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yr9P+LjpY72S0Os7V7Jarsx/dlNjg3Pq1TbnRj7r0 GvJ3yZmdMSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEViUxzI/Ln2IeY3BEMvHL agmR55em5N6b0QUUlXJ49XirlPK7qpq9mdNz3GsZ/ksAAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: retrieve the virtual address before dma_unmap The TSO header was DMA unmapped before the virtual address was retrieved and then used to free the buffer. This meant that we were actually removing the DMA map and then trying to search for it to help in retrieving the virtual address. This lead to a invalid virtual address being used in the kfree call. Fix this by calling dpaa2_iova_to_virt() prior to the dma_unmap call. [ 487.231819] Unable to handle kernel paging request at virtual address fffffd9807000008 (...) [ 487.354061] Hardware name: SolidRun LX2160A Honeycomb (DT) [ 487.359535] pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 487.366485] pc : kfree+0xac/0x304 [ 487.369799] lr : kfree+0x204/0x304 [ 487.373191] sp : ffff80000c4eb120 [ 487.376493] x29: ffff80000c4eb120 x28: ffff662240c46400 x27: 0000000000000001 [ 487.383621] x26: 0000000000000001 x25: ffff662246da0cc0 x24: ffff66224af78000 [ 487.390748] x23: ffffad184f4ce008 x22: ffffad1850185000 x21: ffffad1838d13cec [ 487.397874] x20: ffff6601c0000000 x19: fffffd9807000000 x18: 0000000000000000 [ 487.405000] x17: ffffb910cdc49000 x16: ffffad184d7d9080 x15: 0000000000004000 [ 487.412126] x14: 0000000000000008 x13: 000000000000ffff x12: 0000000000000000 [ 487.419252] x11: 0000000000000004 x10: 0000000000000001 x9 : ffffad184d7d927c [ 487.426379] x8 : 0000000000000000 x7 : 0000000ffffffd1d x6 : ffff662240a94900 [ 487.433505] x5 : 0000000000000003 x4 : 0000000000000009 x3 : ffffad184f4ce008 [ 487.440632] x2 : ffff662243eec000 x1 : 0000000100000100 x0 : fffffc0000000000 [ 487.447758] Call trace: [ 487.450194] kfree+0xac/0x304 [ 487.453151] dpaa2_eth_free_tx_fd.isra.0+0x33c/0x3e0 [fsl_dpaa2_eth] [ 487.459507] dpaa2_eth_tx_conf+0x100/0x2e0 [fsl_dpaa2_eth] [ 487.464989] dpaa2_eth_poll+0xdc/0x380 [fsl_dpaa2_eth] The Linux kernel CVE team has assigned CVE-2022-49452 to this issue. Affected and fixed versions =========================== Issue introduced in 5.18 with commit 3dc709e0cd47c602a8d1a6747f1a91e9737eeed3 and fixed in 5.18.3 with commit ba5fe3dd4833bbc03609c5c0c2dd2cea5fa5addf Issue introduced in 5.18 with commit 3dc709e0cd47c602a8d1a6747f1a91e9737eeed3 and fixed in 5.19 with commit 06d129946a71f3159b3b40ee95549183edf2c79d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49452 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ba5fe3dd4833bbc03609c5c0c2dd2cea5fa5addf https://git.kernel.org/stable/c/06d129946a71f3159b3b40ee95549183edf2c79d