CVE-2022-49605 Information

Description

In the Linux kernel the following vulnerability has been resolved:

igc: Reinstate IGC_REMOVED logic and implement it properly

The initially merged version of the igc driver code (via commit 146740f9abc4 \igc: Add support for PF) contained the following IGC_REMOVED checks in the igc_rd32/wr32() MMIO accessors:

u32 igc_rd32(struct igc_hw hw u32 reg)

	u8 __iomem hw_addr = READ_ONCE(hw->hw_addr);
	u32 value = 0;

	if (IGC_REMOVED(hw_addr))
		return ~value;

	value = readl(&hw_addr[reg]);

	/ reads should not return all F's /
	if (!(~value) && (!reg || !(~readl(hw_addr))))
		hw->hw_addr = NULL;

	return value;

And:

define wr32(reg val) \
do  \
	u8 __iomem hw_addr = READ_ONCE((hw)->hw_addr); \
	if (!IGC_REMOVED(hw_addr)) \
		writel((val) &hw_addr[(reg)]); \
 while (0)

E.g. igb has similar checks in its MMIO accessors and has a similar macro E1000_REMOVED which is implemented as follows:

define E1000_REMOVED(h) unlikely(!(h))

These checks serve to detect and take note of an 0xffffffff MMIO read return from the device which can be caused by a PCIe link flap or some other kind of PCI bus error and to avoid performing MMIO reads and writes from that point onwards.

However the IGC_REMOVED macro was not originally implemented:

ifndef IGC_REMOVED
define IGC_REMOVED(a) (0)
endif / IGC_REMOVED /

This led to the IGC_REMOVED logic to be removed entirely in a subsequent commit (commit 3c215fb18e70 \igc: remove IGC_REMOVED function) with the rationale that such checks matter only for virtualization and that igc does not support virtualization – but a PCIe device can become detached even without virtualization being in use and without proper checks a PCIe bus error affecting an igc adapter will lead to various NULL pointer dereferences as the first access after the error will set hw->hw_addr to NULL and subsequent accesses will blindly dereference this now-NULL pointer.

This patch reinstates the IGC_REMOVED checks in igc_rd32/wr32() and implements IGC_REMOVED the way it is done for igb by checking for the unlikely() case of hw_addr being NULL. This change prevents the oopses seen when a PCIe link flap occurs on an igc adapter.

Reference

https://git.kernel.org/stable/c/16cb6717f4f42487ef10583eb8bc98e7d1e33d65 https://git.kernel.org/stable/c/70965b6e5c03aa70cc754af1226b9f9cde0c4bf3 https://git.kernel.org/stable/c/77836dbe35382aaf8108489060c5c89530c77494 https://git.kernel.org/stable/c/7c1ddcee5311f3315096217881d2dbe47cc683f9 https://git.kernel.org/stable/c/e75b73081f1ec169518773626c2ff3950476660b