Skip to content

DLPX-84907 CVE-2022-3628 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 1, 2023
Merged

DLPX-84907 CVE-2022-3628 #22

merged 1 commit into from
Mar 1, 2023

Conversation

prakashsurya
Copy link
Contributor

No description provided.

@prakashsurya prakashsurya force-pushed the dlpx/pr/prakashsurya/34a1c969-f573-4d86-b8f6-8dcff3efe606 branch from 444d64d to 9105ad7 Compare March 1, 2023 16:59
@prakashsurya prakashsurya marked this pull request as ready for review March 1, 2023 17:02
@prakashsurya prakashsurya enabled auto-merge (squash) March 1, 2023 17:03
@prakashsurya prakashsurya merged commit 6136b34 into 6.0/stage Mar 1, 2023
@prakashsurya prakashsurya deleted the dlpx/pr/prakashsurya/34a1c969-f573-4d86-b8f6-8dcff3efe606 branch March 1, 2023 17:10
delphix-devops-bot pushed a commit that referenced this pull request Mar 4, 2023
DLPX-84907 CVE-2022-3628 (#22)
2ee2015
prakashsurya pushed a commit that referenced this pull request Mar 14, 2023
DLPX-84907 CVE-2022-3628 (#22)
1f1a422
prakashsurya pushed a commit that referenced this pull request Mar 14, 2023
DLPX-84907 CVE-2022-3628 (#22)
577491d
prakashsurya pushed a commit that referenced this pull request Mar 14, 2023
DLPX-84907 CVE-2022-3628 (#22)
9861ff7
delphix-devops-bot pushed a commit that referenced this pull request Mar 30, 2023
DLPX-84907 CVE-2022-3628 (#22)
ddd2e94
delphix-devops-bot pushed a commit that referenced this pull request Apr 20, 2023
DLPX-84907 CVE-2022-3628 (#22)
16a1cee
delphix-devops-bot pushed a commit that referenced this pull request Apr 28, 2023
DLPX-84907 CVE-2022-3628 (#22)
7d6e627
delphix-devops-bot pushed a commit that referenced this pull request May 26, 2023
DLPX-84907 CVE-2022-3628 (#22)
ca67393
delphix-devops-bot pushed a commit that referenced this pull request Jun 3, 2023
DLPX-84907 CVE-2022-3628 (#22)
92792d7
delphix-devops-bot pushed a commit that referenced this pull request Jun 4, 2023
DLPX-84907 CVE-2022-3628 (#22)
3154d6e
delphix-devops-bot pushed a commit that referenced this pull request Jun 5, 2023
DLPX-84907 CVE-2022-3628 (#22)
5c319b3
prakashsurya pushed a commit that referenced this pull request Aug 8, 2023
DLPX-84907 CVE-2022-3628 (#22)
19e9345
delphix-devops-bot pushed a commit that referenced this pull request Aug 23, 2023
@sassmann @smb49
iavf: fix hang on reboot with ice
65912a1 
BugLink: https://bugs.launchpad.net/bugs/2023230

[ Upstream commit 4e264be ]

When a system with E810 with existing VFs gets rebooted the following
hang may be observed.

 Pid 1 is hung in iavf_remove(), part of a network driver:
 PID: 1        TASK: ffff965400e5a340  CPU: 24   COMMAND: "systemd-shutdow"
  #0 [ffffaad04005fa50] __schedule at ffffffff8b3239cb
  #1 [ffffaad04005fae8] schedule at ffffffff8b323e2d
  #2 [ffffaad04005fb00] schedule_hrtimeout_range_clock at ffffffff8b32cebc
  #3 [ffffaad04005fb80] usleep_range_state at ffffffff8b32c930
  #4 [ffffaad04005fbb0] iavf_remove at ffffffffc12b9b4c [iavf]
  #5 [ffffaad04005fbf0] pci_device_remove at ffffffff8add7513
  #6 [ffffaad04005fc10] device_release_driver_internal at ffffffff8af08baa
  #7 [ffffaad04005fc40] pci_stop_bus_device at ffffffff8adcc5fc
  #8 [ffffaad04005fc60] pci_stop_and_remove_bus_device at ffffffff8adcc81e
  #9 [ffffaad04005fc70] pci_iov_remove_virtfn at ffffffff8adf9429
 #10 [ffffaad04005fca8] sriov_disable at ffffffff8adf98e4
 #11 [ffffaad04005fcc8] ice_free_vfs at ffffffffc04bb2c8 [ice]
 #12 [ffffaad04005fd10] ice_remove at ffffffffc04778fe [ice]
 #13 [ffffaad04005fd38] ice_shutdown at ffffffffc0477946 [ice]
 #14 [ffffaad04005fd50] pci_device_shutdown at ffffffff8add58f1
 #15 [ffffaad04005fd70] device_shutdown at ffffffff8af05386
 #16 [ffffaad04005fd98] kernel_restart at ffffffff8a92a870
 #17 [ffffaad04005fda8] __do_sys_reboot at ffffffff8a92abd6
 #18 [ffffaad04005fee0] do_syscall_64 at ffffffff8b317159
 #19 [ffffaad04005ff08] __context_tracking_enter at ffffffff8b31b6fc
 #20 [ffffaad04005ff18] syscall_exit_to_user_mode at ffffffff8b31b50d
 #21 [ffffaad04005ff28] do_syscall_64 at ffffffff8b317169
 #22 [ffffaad04005ff50] entry_SYSCALL_64_after_hwframe at ffffffff8b40009b
     RIP: 00007f1baa5c13d7  RSP: 00007fffbcc55a98  RFLAGS: 00000202
     RAX: ffffffffffffffda  RBX: 0000000000000000  RCX: 00007f1baa5c13d7
     RDX: 0000000001234567  RSI: 0000000028121969  RDI: 00000000fee1dead
     RBP: 00007fffbcc55ca0   R8: 0000000000000000   R9: 00007fffbcc54e90
     R10: 00007fffbcc55050  R11: 0000000000000202  R12: 0000000000000005
     R13: 0000000000000000  R14: 00007fffbcc55af0  R15: 0000000000000000
     ORIG_RAX: 00000000000000a9  CS: 0033  SS: 002b

During reboot all drivers PM shutdown callbacks are invoked.
In iavf_shutdown() the adapter state is changed to __IAVF_REMOVE.
In ice_shutdown() the call chain above is executed, which at some point
calls iavf_remove(). However iavf_remove() expects the VF to be in one
of the states __IAVF_RUNNING, __IAVF_DOWN or __IAVF_INIT_FAILED. If
that's not the case it sleeps forever.
So if iavf_shutdown() gets invoked before iavf_remove() the system will
hang indefinitely because the adapter is already in state __IAVF_REMOVE.

Fix this by returning from iavf_remove() if the state is __IAVF_REMOVE,
as we already went through iavf_shutdown().

Fixes: 9745780 ("iavf: Add waiting so the port is initialized in remove")
Fixes: a841733 ("iavf: Fix race condition between iavf_shutdown and iavf_remove")
Reported-by: Marius Cornea <[email protected]>
Signed-off-by: Stefan Assmann <[email protected]>
Reviewed-by: Michal Kubiak <[email protected]>
Tested-by: Rafal Romanowski <[email protected]>
Signed-off-by: Tony Nguyen <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Signed-off-by: Kamal Mostafa <[email protected]>
Signed-off-by: Luke Nowakowski-Krijger <[email protected]>
delphix-devops-bot pushed a commit that referenced this pull request Aug 24, 2023
DLPX-84907 CVE-2022-3628 (#22)
e241411
delphix-devops-bot pushed a commit that referenced this pull request Aug 25, 2023
DLPX-84907 CVE-2022-3628 (#22)
8763ab6
delphix-devops-bot pushed a commit that referenced this pull request Aug 26, 2023
DLPX-84907 CVE-2022-3628 (#22)
d548047
delphix-devops-bot pushed a commit that referenced this pull request Aug 27, 2023
DLPX-84907 CVE-2022-3628 (#22)
7d015da
delphix-devops-bot pushed a commit that referenced this pull request Sep 2, 2023
DLPX-84907 CVE-2022-3628 (#22)
d1f0deb
delphix-devops-bot pushed a commit that referenced this pull request Sep 3, 2023
DLPX-84907 CVE-2022-3628 (#22)
3df5672
delphix-devops-bot pushed a commit that referenced this pull request Sep 4, 2023
DLPX-84907 CVE-2022-3628 (#22)
f77ecd6
delphix-devops-bot pushed a commit that referenced this pull request Sep 5, 2023
DLPX-84907 CVE-2022-3628 (#22)
f7d8a04
delphix-devops-bot pushed a commit that referenced this pull request Sep 6, 2023
DLPX-84907 CVE-2022-3628 (#22)
08b044f
delphix-devops-bot pushed a commit that referenced this pull request Aug 23, 2024
DLPX-84907 CVE-2022-3628 (#22)
b79f49c
prakashsurya pushed a commit that referenced this pull request Sep 23, 2024
@prakashsurya
DLPX-84907 CVE-2022-3628 (#22)
15d34c6
delphix-devops-bot pushed a commit that referenced this pull request Oct 20, 2024
DLPX-84907 CVE-2022-3628 (#22)
bc588d0
delphix-devops-bot pushed a commit that referenced this pull request Oct 21, 2024
DLPX-84907 CVE-2022-3628 (#22)
9a06c27
palash-gandhi pushed a commit that referenced this pull request Oct 24, 2024
@palash-gandhi
DLPX-84907 CVE-2022-3628 (#22)
dd6fa10
delphix-devops-bot pushed a commit that referenced this pull request Nov 10, 2024
DLPX-84907 CVE-2022-3628 (#22)
8d3a659
delphix-devops-bot pushed a commit that referenced this pull request Nov 11, 2024
DLPX-84907 CVE-2022-3628 (#22)
1390e0a
delphix-devops-bot pushed a commit that referenced this pull request Dec 18, 2024
DLPX-84907 CVE-2022-3628 (#22)
b5c8c6f
delphix-devops-bot pushed a commit that referenced this pull request Dec 19, 2024
DLPX-84907 CVE-2022-3628 (#22)
9ab3715
delphix-devops-bot pushed a commit that referenced this pull request Dec 20, 2024
DLPX-84907 CVE-2022-3628 (#22)
df7d711
delphix-devops-bot pushed a commit that referenced this pull request Dec 21, 2024
DLPX-84907 CVE-2022-3628 (#22)
0795786
delphix-devops-bot pushed a commit that referenced this pull request Dec 22, 2024
DLPX-84907 CVE-2022-3628 (#22)
8a45b5b
delphix-devops-bot pushed a commit that referenced this pull request Dec 23, 2024
DLPX-84907 CVE-2022-3628 (#22)
f9b27af
delphix-devops-bot pushed a commit that referenced this pull request Dec 24, 2024
DLPX-84907 CVE-2022-3628 (#22)
27806c0
delphix-devops-bot pushed a commit that referenced this pull request Dec 25, 2024
DLPX-84907 CVE-2022-3628 (#22)
6a3b1ed
delphix-devops-bot pushed a commit that referenced this pull request Dec 26, 2024
DLPX-84907 CVE-2022-3628 (#22)
6c4f20e
delphix-devops-bot pushed a commit that referenced this pull request Dec 27, 2024
DLPX-84907 CVE-2022-3628 (#22)
a9aada5
delphix-devops-bot pushed a commit that referenced this pull request Dec 28, 2024
DLPX-84907 CVE-2022-3628 (#22)
5b4bb72
delphix-devops-bot pushed a commit that referenced this pull request Dec 29, 2024
DLPX-84907 CVE-2022-3628 (#22)
688fcec
delphix-devops-bot pushed a commit that referenced this pull request Dec 30, 2024
DLPX-84907 CVE-2022-3628 (#22)
626eb18
delphix-devops-bot pushed a commit that referenced this pull request Dec 31, 2024
DLPX-84907 CVE-2022-3628 (#22)
3ce56eb
delphix-devops-bot pushed a commit that referenced this pull request Jan 1, 2025
DLPX-84907 CVE-2022-3628 (#22)
67fe340
delphix-devops-bot pushed a commit that referenced this pull request Jan 2, 2025
DLPX-84907 CVE-2022-3628 (#22)
6a6860f
delphix-devops-bot pushed a commit that referenced this pull request Jan 3, 2025
DLPX-84907 CVE-2022-3628 (#22)
5e3ba00
delphix-devops-bot pushed a commit that referenced this pull request Jan 4, 2025
DLPX-84907 CVE-2022-3628 (#22)
2f671b4
delphix-devops-bot pushed a commit that referenced this pull request Jan 5, 2025
DLPX-84907 CVE-2022-3628 (#22)
af7fd9c
delphix-devops-bot pushed a commit that referenced this pull request Jan 6, 2025
DLPX-84907 CVE-2022-3628 (#22)
282973b
delphix-devops-bot pushed a commit that referenced this pull request Jan 7, 2025
DLPX-84907 CVE-2022-3628 (#22)
17d9b55
delphix-devops-bot pushed a commit that referenced this pull request Jan 31, 2025
DLPX-84907 CVE-2022-3628 (#22)
a008261
delphix-devops-bot pushed a commit that referenced this pull request Sep 25, 2025
@Tropicao @smb49
net: stmmac: make sure that ptp_rate is not 0 before configuring time…
55eff19 
…stamping

BugLink: https://bugs.launchpad.net/bugs/2119603

[ Upstream commit 030ce919e114a111e83b7976ecb3597cefd33f26 ]

The stmmac platform drivers that do not open-code the clk_ptp_rate value
after having retrieved the default one from the device-tree can end up
with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will
eventually propagate up to PTP initialization when bringing up the
interface, leading to a divide by 0:

 Division by zero in kernel.
 CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22
 Hardware name: STM32 (Device Tree Support)
 Call trace:
  unwind_backtrace from show_stack+0x18/0x1c
  show_stack from dump_stack_lvl+0x6c/0x8c
  dump_stack_lvl from Ldiv0_64+0x8/0x18
  Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4
  stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c
  stmmac_hw_setup from __stmmac_open+0x18c/0x434
  __stmmac_open from stmmac_open+0x3c/0xbc
  stmmac_open from __dev_open+0xf4/0x1ac
  __dev_open from __dev_change_flags+0x1cc/0x224
  __dev_change_flags from dev_change_flags+0x24/0x60
  dev_change_flags from ip_auto_config+0x2e8/0x11a0
  ip_auto_config from do_one_initcall+0x84/0x33c
  do_one_initcall from kernel_init_freeable+0x1b8/0x214
  kernel_init_freeable from kernel_init+0x24/0x140
  kernel_init from ret_from_fork+0x14/0x28
 Exception stack(0xe0815fb0 to 0xe0815ff8)

Prevent this division by 0 by adding an explicit check and error log
about the actual issue. While at it, remove the same check from
stmmac_ptp_register, which then becomes duplicate

Fixes: 19d857c ("stmmac: Fix calculations for ptp counters when clock input = 50Mhz.")
Signed-off-by: Alexis Lothoré <[email protected]>
Reviewed-by: Yanteng Si <[email protected]>
Reviewed-by: Maxime Chevallier <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
CVE-2025-38126
Signed-off-by: Manuel Diewald <[email protected]>
Signed-off-by: Mehmet Basaran <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

2 more reviewers

@sdimitro sdimitro sdimitro approved these changes

@don-brady don-brady don-brady approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@prakashsurya @sdimitro @don-brady