Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-56717

net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic() Packets injected by the CPU should have a SRC_PORT field equal to the CPU port module index in the Analyzer block (ocelot->num_phys_ports). The blamed commit copied the ocelot_ifh_set_basic() call incorrectly from ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling with "x", it calls with BIT_ULL(x), but the field is not a port mask, but rather a single port index. [ side note: this is the technical debt of code duplication :( ] The error used to be silent and doesn't appear to have other user-visible manifestations, but with new changes in the packing library, it now fails loudly as follows: ------------[ cut here ]------------ Cannot store 0x40 inside bits 46-43 - will truncate sja1105 spi2.0: xmit timed out WARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198 sja1105 spi2.0: timed out polling for tstamp CPU: 1 UID: 0 PID: 102 Comm: felix_xmit Tainted: G W N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605 Call trace: __pack+0x90/0x198 (P) __pack+0x90/0x198 (L) packing+0x78/0x98 ocelot_ifh_set_basic+0x260/0x368 ocelot_port_inject_frame+0xa8/0x250 felix_port_deferred_xmit+0x14c/0x258 kthread_worker_fn+0x134/0x350 kthread+0x114/0x138 The code path pertains to the ocelot switchdev driver and to the felix secondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q. The messenger (packing) is not really to blame, so fix the original commit instead.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 06bcb9032e05ad717f9fd0a6e2fd3ae7f430fa31 to < 59c4ca8d8d7918eb6e2df91d2c254827264be309affected
  • ff7f554bbd75d5cbf00cded81d05147c6617e876 to < 2f3c62ffe88116cd2a39cd73e01103535599970faffected
  • e1b9e80236c540fa85d76e2d510d1b38e1968c5d to < a8836eae3288c351acd3b2743d2fad2a4ee2bd56affected
  • e1b9e80236c540fa85d76e2d510d1b38e1968c5d to < 2d5df3a680ffdaf606baa10636bdb1daf757832eaffected
  • be3a532167dd562ec38900c846e7ae6cc39aa2f1affected
  • 6.1.107 to < 6.1.122affected
  • 6.6.48 to < 6.6.68affected
  • 6.10.7 to < 6.11affected

Linux Linux

Default version status: affected

  • 6.11affected
  • 0 to < 6.11unaffected
  • 6.1.122 to ≤ 6.1.*unaffected
  • 6.6.68 to ≤ 6.6.*unaffected
  • 6.12.7 to ≤ 6.12.*unaffected
  • 6.13 to ≤ *unaffected

References