CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix TSO DMA API usage causing oops
Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of txskbuffdma[]'s members to be later in stmmactsoxmit().
The buf (dma cookie) and len stored in this structure are passed to dmaunmapsingle() by stmmactxclean(). The DMA API requires that the dma cookie passed to dmaunmapsingle() is the same as the value returned from dmamapsingle(). However, by moving the assignment later, this is not the case when priv->dmacap.addr64 > 32 as "des" is offset by protohdrlen.
This causes problems such as:
dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed
and with DMAAPIDEBUG enabled:
DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes]
Fix this by maintaining "des" as the original DMA cookie, and use tsodes to pass the offset DMA cookie to stmmactsoallocator().
Full details of the crashes can be found at: https://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/ https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.76.1-1 - Upgrade
Upgrade
Linux kernel net: stmmacto a version that resolves this vulnerability.Fixed in 66600fac7a98Patch 66600fac7a98 - Configuration
In the stmmac TSO implementation, ensure that the DMA cookie passed to dma_unmap_single() by stmmac_tx_clean() exactly matches the value returned from dma_map_single(); maintain "des" as the original DMA cookie and use "tso_des" to pass the offset DMA cookie to stmmac_tso_allocator() (this addresses the issue introduced when tx_skbuff_dma[] members were moved later in stmmac_tso_xmit()).
stmmac (TSO path) DMA cookie handling (des/tso_des) = Maintain "des" as the original DMA cookie from dma_map_single() and pass the offset DMA cookie via "tso_des" to stmmac_tso_allocator()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56719?
CVE-2024-56719 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-56719?
To fix CVE-2024-56719, update your Linux kernel to a version that has addressed this vulnerability.
What software versions are affected by CVE-2024-56719?
CVE-2024-56719 affects various versions of the Linux kernel ranging from 5.15.171 to 6.12.7, including specific release candidates.
What type of vulnerability is CVE-2024-56719?
CVE-2024-56719 involves an issue with the TSO DMA API usage in the Linux kernel, leading to potential system instability.
Is there a known exploit for CVE-2024-56719?
As of now, there are no publicly known exploits specifically targeting CVE-2024-56719.