[PATCH OLK-5.10 0/2] CVE-2025-38111
Andrew Lunn (1): net: mdio: C22 is now optional, EOPNOTSUPP if not provided Jakub Raczynski (1): net/mdiobus: Fix potential out-of-bounds read/write access drivers/net/phy/mdio_bus.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) -- 2.9.5
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/20058 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/UMY... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/20058 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/UMY...
From: Andrew Lunn <andrew@lunn.ch> stable inclusion from stable-v5.10.239 commit 72e9c8aa595b3ec65488099ed0c541c7cae4bfd9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9645 CVE: CVE-2025-38111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit b063b1924fd9bf0bc157cf644764dc2151d04ccc ] When performing a C22 operation, check that the bus driver actually provides the methods, and return -EOPNOTSUPP if not. C45 only busses do exist, and in future their C22 methods will be NULL. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Michael Walle <michael@walle.cc> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Stable-dep-of: 0e629694126c ("net/mdiobus: Fix potential out-of-bounds read/write access") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> --- drivers/net/phy/mdio_bus.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 33467f1..69d6879 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -753,7 +753,10 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum) WARN_ON_ONCE(!mutex_is_locked(&bus->mdio_lock)); - retval = bus->read(bus, addr, regnum); + if (bus->read) + retval = bus->read(bus, addr, regnum); + else + retval = -EOPNOTSUPP; trace_mdio_access(bus, 1, addr, regnum, retval, retval); mdiobus_stats_acct(&bus->stats[addr], true, retval); @@ -779,7 +782,10 @@ int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val) WARN_ON_ONCE(!mutex_is_locked(&bus->mdio_lock)); - err = bus->write(bus, addr, regnum, val); + if (bus->write) + err = bus->write(bus, addr, regnum, val); + else + err = -EOPNOTSUPP; trace_mdio_access(bus, 0, addr, regnum, val, err); mdiobus_stats_acct(&bus->stats[addr], false, err); -- 2.9.5
From: Jakub Raczynski <j.raczynski@samsung.com> stable inclusion from stable-v5.10.239 commit 19c5875e26c4ed5686d82a7d8f7051385461b9eb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9645 CVE: CVE-2025-38111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 0e629694126ca388916f059453a1c36adde219c4 ] When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation. Fixes: 080bb352fad00 ("net: phy: Maintain MDIO device and bus statistics") Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com> Reported-by: Wenjing Shan <wenjing.shan@samsung.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> --- drivers/net/phy/mdio_bus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 69d6879..e2808c4 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -753,6 +753,9 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum) WARN_ON_ONCE(!mutex_is_locked(&bus->mdio_lock)); + if (addr >= PHY_MAX_ADDR) + return -ENXIO; + if (bus->read) retval = bus->read(bus, addr, regnum); else @@ -782,6 +785,9 @@ int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val) WARN_ON_ONCE(!mutex_is_locked(&bus->mdio_lock)); + if (addr >= PHY_MAX_ADDR) + return -ENXIO; + if (bus->write) err = bus->write(bus, addr, regnum, val); else -- 2.9.5
participants (2)
-
patchwork bot -
Zhang Changzhong