linux-cve-announce - CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2024111900-CVE-2024-50296-774e@gregkh>
Date: Tue, 19 Nov 2024 02:32:51 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix kernel crash when uninstalling driver

When the driver is uninstalled and the VF is disabled concurrently, a
kernel crash occurs. The reason is that the two actions call function
pci_disable_sriov(). The num_VFs is checked to determine whether to
release the corresponding resources. During the second calling, num_VFs
is not 0 and the resource release function is called. However, the
corresponding resource has been released during the first invoking.
Therefore, the problem occurs:

[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
...
[15278.131557][T50670] Call trace:
[15278.134686][T50670]  klist_put+0x28/0x12c
[15278.138682][T50670]  klist_del+0x14/0x20
[15278.142592][T50670]  device_del+0xbc/0x3c0
[15278.146676][T50670]  pci_remove_bus_device+0x84/0x120
[15278.151714][T50670]  pci_stop_and_remove_bus_device+0x6c/0x80
[15278.157447][T50670]  pci_iov_remove_virtfn+0xb4/0x12c
[15278.162485][T50670]  sriov_disable+0x50/0x11c
[15278.166829][T50670]  pci_disable_sriov+0x24/0x30
[15278.171433][T50670]  hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3]
[15278.178039][T50670]  hclge_exit+0x28/0xd0 [hclge]
[15278.182730][T50670]  __se_sys_delete_module.isra.0+0x164/0x230
[15278.188550][T50670]  __arm64_sys_delete_module+0x1c/0x30
[15278.193848][T50670]  invoke_syscall+0x50/0x11c
[15278.198278][T50670]  el0_svc_common.constprop.0+0x158/0x164
[15278.203837][T50670]  do_el0_svc+0x34/0xcc
[15278.207834][T50670]  el0_svc+0x20/0x30

For details, see the following figure.

     rmmod hclge              disable VFs
----------------------------------------------------
hclge_exit()            sriov_numvfs_store()
  ...                     device_lock()
  pci_disable_sriov()     hns3_pci_sriov_configure()
                            pci_disable_sriov()
                              sriov_disable()
    sriov_disable()             if !num_VFs :
      if !num_VFs :               return;
        return;                 sriov_del_vfs()
      sriov_del_vfs()             ...
        ...                       klist_put()
        klist_put()               ...
        ...                     num_VFs = 0;
      num_VFs = 0;        device_unlock();

In this patch, when driver is removing, we get the device_lock()
to protect num_VFs, just like sriov_numvfs_store().

The Linux kernel CVE team has assigned CVE-2024-50296 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.19.214 with commit b06ad258e013 and fixed in 4.19.324 with commit a0df055775f3
	Issue introduced in 5.4.156 with commit c4b64011e458 and fixed in 5.4.286 with commit 7ae4e56de7db
	Issue introduced in 5.10.76 with commit d36b15e3e7b5 and fixed in 5.10.230 with commit 590a4b2d4e0b
	Issue introduced in 5.15 with commit 0dd8a25f355b and fixed in 5.15.172 with commit e36482b222e0
	Issue introduced in 5.15 with commit 0dd8a25f355b and fixed in 6.1.117 with commit 76b155e14d9b
	Issue introduced in 5.15 with commit 0dd8a25f355b and fixed in 6.6.61 with commit 719edd9f3372
	Issue introduced in 5.15 with commit 0dd8a25f355b and fixed in 6.11.8 with commit b5c94e4d947d
	Issue introduced in 5.15 with commit 0dd8a25f355b and fixed in 6.12 with commit df3dff8ab6d7
	Issue introduced in 5.14.15 with commit 9b5a29f0acef

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-50296
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/hisilicon/hns3/hnae3.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a0df055775f30850c0da8f7dab40d67c0fd63908
	https://git.kernel.org/stable/c/7ae4e56de7dbd0999578246a536cf52a63f4056d
	https://git.kernel.org/stable/c/590a4b2d4e0b73586e88bce9b8135b593355ec09
	https://git.kernel.org/stable/c/e36482b222e00cc7aeeea772fc0cf2943590bc4d
	https://git.kernel.org/stable/c/76b155e14d9b182ce83d32ada2d0d7219ea8c8dd
	https://git.kernel.org/stable/c/719edd9f3372ce7fb3b157647c6658672946874b
	https://git.kernel.org/stable/c/b5c94e4d947d15d521e935ff10c5a22a7883dea5
	https://git.kernel.org/stable/c/df3dff8ab6d79edc942464999d06fbaedf8cdd18