linux-cve-announce - CVE-2025-68220: net: ethernet: ti: netcp: Standardize knav_dma_open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025121633-CVE-2025-68220-9526@gregkh>
Date: Tue, 16 Dec 2025 14:57:39 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-68220: net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error

Make knav_dma_open_channel consistently return NULL on error instead
of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h
returns NULL when the driver is disabled, but the driver
implementation does not even return NULL or ERR_PTR on failure,
causing inconsistency in the users. This results in a crash in
netcp_free_navigator_resources as followed (trimmed):

Unhandled fault: alignment exception (0x221) at 0xfffffff2
[fffffff2] *pgd=80000800207003, *pmd=82ffda003, *pte=00000000
Internal error: : 221 [#1] SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc7 #1 NONE
Hardware name: Keystone
PC is at knav_dma_close_channel+0x30/0x19c
LR is at netcp_free_navigator_resources+0x2c/0x28c

[... TRIM...]

Call trace:
 knav_dma_close_channel from netcp_free_navigator_resources+0x2c/0x28c
 netcp_free_navigator_resources from netcp_ndo_open+0x430/0x46c
 netcp_ndo_open from __dev_open+0x114/0x29c
 __dev_open from __dev_change_flags+0x190/0x208
 __dev_change_flags from netif_change_flags+0x1c/0x58
 netif_change_flags from dev_change_flags+0x38/0xa0
 dev_change_flags from ip_auto_config+0x2c4/0x11f0
 ip_auto_config from do_one_initcall+0x58/0x200
 do_one_initcall from kernel_init_freeable+0x1cc/0x238
 kernel_init_freeable from kernel_init+0x1c/0x12c
 kernel_init from ret_from_fork+0x14/0x38
[... TRIM...]

Standardize the error handling by making the function return NULL on
all error conditions. The API is used in just the netcp_core.c so the
impact is limited.

Note, this change, in effect reverts commit 5b6cb43b4d62 ("net:
ethernet: ti: netcp_core: return error while dma channel open issue"),
but provides a less error prone implementation.

The Linux kernel CVE team has assigned CVE-2025-68220 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.12 with commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 and fixed in 5.4.302 with commit af6b10a13fc0aee37df4a8292414cc055c263fa3
	Issue introduced in 4.12 with commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 and fixed in 5.10.247 with commit 8427218ecbd7f8559c37972e66cb0fa06e82353b
	Issue introduced in 4.12 with commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 and fixed in 5.15.197 with commit 3afeb909c3e2e0eb19b1e20506196e5f2d9c2259
	Issue introduced in 4.12 with commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 and fixed in 6.1.159 with commit 2572c358ee434ce4b994472cceeb4043cbff5bc5
	Issue introduced in 4.12 with commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 and fixed in 6.6.118 with commit 952637c5b9be64539cd0e13ef88db71a1df46373
	Issue introduced in 4.12 with commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 and fixed in 6.12.60 with commit fbb53727ca789a8d27052aab4b77ca9e2a0fae2b
	Issue introduced in 4.12 with commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 and fixed in 6.17.10 with commit f9608637ecc165d7d6341df105aee44691461fb9
	Issue introduced in 4.12 with commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 and fixed in 6.18 with commit 90a88306eb874fe4bbdd860e6c9787f5bbc588b5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-68220
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/ti/netcp_core.c
	drivers/soc/ti/knav_dma.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/af6b10a13fc0aee37df4a8292414cc055c263fa3
	https://git.kernel.org/stable/c/8427218ecbd7f8559c37972e66cb0fa06e82353b
	https://git.kernel.org/stable/c/3afeb909c3e2e0eb19b1e20506196e5f2d9c2259
	https://git.kernel.org/stable/c/2572c358ee434ce4b994472cceeb4043cbff5bc5
	https://git.kernel.org/stable/c/952637c5b9be64539cd0e13ef88db71a1df46373
	https://git.kernel.org/stable/c/fbb53727ca789a8d27052aab4b77ca9e2a0fae2b
	https://git.kernel.org/stable/c/f9608637ecc165d7d6341df105aee44691461fb9
	https://git.kernel.org/stable/c/90a88306eb874fe4bbdd860e6c9787f5bbc588b5