[LTS 9.2] net: mdio: fix undefined behavior in bit shift for __mdiobus_register #358
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[LTS 9.2]
CVE-2022-49907
VULN-66416
Problem
https://www.cve.org/CVERecord?id=CVE-2022-49907
Applicability: yes
The bug applies to LTS 9.2: the affected MDIO bus driver is central to the control of any ethernet interface device. The patch 40e4eb3 is not backported onto LTS 9.2, yet it is backported onto its mainline sibling stable 5.15 in 985a88b.
Solution
The solution in 40e4eb3 involves using the
BIT(i)
macro instead of the raw bit shift1 << i
to obtain anint
with i -th bit set. The fully expandedBIT(i)
macro boils down to1UL << i
construct operating on unsigned type where the left shit is defined for the full range of the type's bits (seeinclude/vdso/bits.h
,include/uapi/linux/const.h
,include/linux/bits.h
).kABI check: passed
Boot test: passed
boot-test.log
Kselftests: passed relative
Coverage
All the network-related tests (except the unstable ones):
net/forwarding
(exceptmirror_gre_bridge_1d_vlan.sh
,sch_tbf_ets.sh
,tc_actions.sh
,sch_tbf_root.sh
,vxlan_bridge_1d_ipv6.sh
,sch_red.sh
,dual_vxlan_bridge.sh
,tc_police.sh
,sch_tbf_prio.sh
,mirror_gre_vlan_bridge_1q.sh
,sch_ets.sh
,ipip_hier_gre_keys.sh
,q_in_vni.sh
),net/mptcp
(exceptsimult_flows.sh
,userspace_pm.sh
),net
(exceptreuseaddr_conflict
,fib_nexthops.sh
,reuseport_addr_any.sh
,udpgro_fwd.sh
,gro.sh
,udpgso_bench.sh
,txtimestamp.sh
,xfrm_policy.sh
,ip_defrag.sh
),netfilter
(exceptnft_trans_stress.sh
).Reference
kselftests–ciqlts9_2–run1.log
Patch
kselftests–ciqlts9_2-CVE-2022-49907–run1.log
kselftests–ciqlts9_2-CVE-2022-49907–run2.log
Comparison
The tests results are the same for both patch and reference
Specific tests: could not replicate
An attempt was made to replicate the bug by compiling the kernel with
CONFIG_UBSAN=y
. Unfortunately the integer overflows resulting from bit shifts were not being captured by UBSAN, not only in the affected driver, but in general, as could have been demonstrated with the modifiedtest_ubsan
module (enabled withCONFIG_TEST_UBSAN=y
) where thetest_ubsan_shift_out_of_bounds
test case inlib/test_ubsan.c
:was augmented with the exact operation as reported in the CVE:
Both original "left overflow" and the added "shift out of bounds" tests were ignored by UBSAN at runtime, despite
CONFIG_UBSAN_SHIFT
option reported to bey
:After this unsuccessful replication attempt the specific testing efforts were then abandoned.