From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E579BE46 for ; Sat, 16 Aug 2025 11:14:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1755342851; cv=none; b=YkcJn2SXYy9RY1iDHPmRKgdNvwDo5bVVQViHosYuGqd4sUOJZ3GDAyYmpbtlEjqeHNBA8utuU6cDEk3teiqK6BbZZ6YRQGVOJcxjoselDRqJEKhs5X2pprCLuf8Ncb7fDzwrr8AAXLGoRtoj0rhCxT6RIXUaGXMRBBLELsjCFqc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1755342851; c=relaxed/simple; bh=PAmtaAxmntU5H+It5efMIjhoJYO7R91kYcVXnLbxP0E=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UDIh/TGLaAJn4i4qlu6nCbGepfRQOJrVrAr9ah+MLpdKC2UngmbtyA4p9Zskbn/lfVa6FYvnaqQZjN69hCz7jclivArd9rkxfQmF3jBdSeCjiGkZ37SlOgyofhRo4gS2jVgQaU5LHAPWpaBh8Z0iiyiyEM+VN+CgeIor39YfOFE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ee0Mz34p; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Ee0Mz34p" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C910C4CEF4; Sat, 16 Aug 2025 11:14:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1755342850; bh=PAmtaAxmntU5H+It5efMIjhoJYO7R91kYcVXnLbxP0E=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Ee0Mz34p08nJ00fwryqjDifuy2eOUZlqVsqctLEMahGmnnCXseIQIFCtv3tpn5TIH EGh3CbLBNlvQDYeZCkRitw0vD62jkcoJPZQsCDOge2AYMKFBexpwKl8ga6v3ZNi6m8 aTUMimrSqCjlNZkJU3+3HwPav/ETDTsIyarNgvM4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-38532: net: libwx: properly reset Rx ring descriptor Date: Sat, 16 Aug 2025 13:14:03 +0200 Message-ID: <2025081655-CVE-2025-38532-e625@gregkh> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=6510; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=bVKgQoE134bdeluK7TH05Ru7PAVmIn1uXGmlj+4XQo8=; b=owGbwMvMwCRo6H6F97bub03G02pJDBkL0j/v+j57Puv+YIklHCtvKRXN3TM52iLmx/XOov835 JIEf4a5dcSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEPlgyzDPm9JRdeilrlUld NNNm/jWyW7SE9zEsmLrg6pVsaeadXw2+//Y9/u5wwaL9qwE= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net: libwx: properly reset Rx ring descriptor When device reset is triggered by feature changes such as toggling Rx VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The hardware descriptor ring may retain stale values from previous sessions. And only set the length to 0 in rx_desc[0] would result in building malformed SKBs. Fix it to ensure a clean slate after device reset. [ 549.186435] [ C16] ------------[ cut here ]------------ [ 549.186457] [ C16] kernel BUG at net/core/skbuff.c:2814! [ 549.186468] [ C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 549.186472] [ C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary) [ 549.186476] [ C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 549.186478] [ C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510 [ 549.186484] [ C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8 [ 549.186487] [ C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282 [ 549.186490] [ C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2 [ 549.186492] [ C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40 [ 549.186494] [ C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e [ 549.186496] [ C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200 [ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2 [ 549.186499] [ C16] FS: 0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000 [ 549.186502] [ C16] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 549.186503] [ C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0 [ 549.186505] [ C16] PKRU: 55555554 [ 549.186507] [ C16] Call Trace: [ 549.186510] [ C16] [ 549.186513] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186517] [ C16] __skb_pad+0xc7/0xf0 [ 549.186523] [ C16] wx_clean_rx_irq+0x355/0x3b0 [libwx] [ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx] [ 549.186540] [ C16] __napi_poll+0x28/0x190 [ 549.186544] [ C16] net_rx_action+0x301/0x3f0 [ 549.186548] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186551] [ C16] ? __raw_spin_lock_irqsave+0x1e/0x50 [ 549.186554] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186557] [ C16] ? wake_up_nohz_cpu+0x35/0x160 [ 549.186559] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186563] [ C16] handle_softirqs+0xf9/0x2c0 [ 549.186568] [ C16] __irq_exit_rcu+0xc7/0x130 [ 549.186572] [ C16] common_interrupt+0xb8/0xd0 [ 549.186576] [ C16] [ 549.186577] [ C16] [ 549.186579] [ C16] asm_common_interrupt+0x22/0x40 [ 549.186582] [ C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 549.186585] [ C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 549.186587] [ C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246 [ 549.186590] [ C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000 [ 549.186591] [ C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3 [ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000 [ 549.186595] [ C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40 [ 549.186596] [ C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000 [ 549.186601] [ C16] ? cpuidle_enter_state+0xb3/0x420 [ 549.186605] [ C16] cpuidle_enter+0x29/0x40 [ 549.186609] [ C16] cpuidle_idle_call+0xfd/0x170 [ 549.186613] [ C16] do_idle+0x7a/0xc0 [ 549.186616] [ C16] cpu_startup_entry+0x25/0x30 [ 549.186618] [ C16] start_secondary+0x117/0x140 [ 549.186623] [ C16] common_startup_64+0x13e/0x148 [ 549.186628] [ C16] The Linux kernel CVE team has assigned CVE-2025-38532 to this issue. Affected and fixed versions =========================== Issue introduced in 6.3 with commit 3c47e8ae113a68da47987750d9896e325d0aeedd and fixed in 6.6.100 with commit d510116c80b37efb100ce8d5ee326214b0157293 Issue introduced in 6.3 with commit 3c47e8ae113a68da47987750d9896e325d0aeedd and fixed in 6.12.40 with commit 10e27b2a6ebeda49e9c2897a699d3ce1ded565ee Issue introduced in 6.3 with commit 3c47e8ae113a68da47987750d9896e325d0aeedd and fixed in 6.15.8 with commit ee527d3fba4dae1d619d2d0438624002c8e99e24 Issue introduced in 6.3 with commit 3c47e8ae113a68da47987750d9896e325d0aeedd and fixed in 6.16 with commit d992ed7e1b687ad7df0763d3e015a5358646210b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-38532 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/wangxun/libwx/wx_hw.c drivers/net/ethernet/wangxun/libwx/wx_lib.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d510116c80b37efb100ce8d5ee326214b0157293 https://git.kernel.org/stable/c/10e27b2a6ebeda49e9c2897a699d3ce1ded565ee https://git.kernel.org/stable/c/ee527d3fba4dae1d619d2d0438624002c8e99e24 https://git.kernel.org/stable/c/d992ed7e1b687ad7df0763d3e015a5358646210b