linux-cve-announce - CVE-2022-49192: drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via ethtool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022616-CVE-2022-49192-b1e7@gregkh>
Date: Wed, 26 Feb 2025 02:56:37 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49192: drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via ethtool

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via ethtool

cpsw_ethtool_begin directly returns the result of pm_runtime_get_sync
when successful.
pm_runtime_get_sync returns -error code on failure and 0 on successful
resume but also 1 when the device is already active. So the common case
for cpsw_ethtool_begin is to return 1. That leads to inconsistent calls
to pm_runtime_put in the call-chain so that pm_runtime_put is called
one too many times and as result leaving the cpsw dev behind suspended.

The suspended cpsw dev leads to an access violation later on by
different parts of the cpsw driver.

Fix this by calling the return-friendly pm_runtime_resume_and_get
function.

The Linux kernel CVE team has assigned CVE-2022-49192 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit d43c65b05b848e0b2db1a6c78b02c189da3a95b5 and fixed in 5.15.33 with commit 585dc196a08fccdcd1b7fcf473cf566b34c4b840
	Issue introduced in 5.15 with commit d43c65b05b848e0b2db1a6c78b02c189da3a95b5 and fixed in 5.16.19 with commit 459080fab12b23c0526026e5cedbf3fabb5457cc
	Issue introduced in 5.15 with commit d43c65b05b848e0b2db1a6c78b02c189da3a95b5 and fixed in 5.17.2 with commit 30ad11bff021a94aff6dab1ec9236fdfd884fbff
	Issue introduced in 5.15 with commit d43c65b05b848e0b2db1a6c78b02c189da3a95b5 and fixed in 5.18 with commit 2844e2434385819f674d1fb4130c308c50ba681e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49192
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/ti/cpsw_ethtool.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/585dc196a08fccdcd1b7fcf473cf566b34c4b840
	https://git.kernel.org/stable/c/459080fab12b23c0526026e5cedbf3fabb5457cc
	https://git.kernel.org/stable/c/30ad11bff021a94aff6dab1ec9236fdfd884fbff
	https://git.kernel.org/stable/c/2844e2434385819f674d1fb4130c308c50ba681e