REDHAT-BUG-2347781: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:
powerpc/paprscm: don't requests stats with '0' sized stats buffer
Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being reported with vPMEM when paprscm probe is being called. The panic is of the form below and is observed only with following option disabled(profile) for the said LPAR 'Enable Performance Information Collection' in the HMC:
Kernel attempted to write user page (1c) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x0000001c Faulting instruction address: 0xc008000001b90844 Oops: Kernel access of bad area, sig: 11 [#1] <snip> NIP [c008000001b90844] drcpmemquerystats+0x5c/0x270 [paprscm] LR [c008000001b92794] paprscmprobe+0x2ac/0x6ec [paprscm] Call Trace: 0xc00000000941bca0 (unreliable) paprscmprobe+0x2ac/0x6ec [paprscm] platformprobe+0x98/0x150 reallyprobe+0xfc/0x510 driverprobedevice+0x17c/0x230 <snip> ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Fatal exception
On investigation looks like this panic was caused due to a 'statbuffer' of size==0 being provided to drcpmemquerystats() to fetch all performance stats-ids of an NVDIMM. However drcpmemquerystats() shouldn't have been called since the vPMEM NVDIMM doesn't support and performance stat-id's. This was caused due to missing check for 'p->statbufferlen' at the beginning of paprscmpmucheckevents() which indicates that the NVDIMM doesn't support performance-stats.
Fix this by introducing the check for 'p->statbufferlen' at the beginning of paprscmpmucheckevents().
[1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the HMC LPAR option "Enable Performance Information Collection" is disabled for the affected vPMEM/LPAR, since the issue occurs only with that option disabled and leads to papr_scm probe requesting stats with a 0-sized stats buffer.
powerpc/papr_scm (papr_scm) Enable Performance Information Collection (HMC LPAR setting) = disabled - Configuration
Implement the missing check for 'p->stat_buffer_len' at the beginning of drc_pmem_query_stats(), and do not request stats when the provided stats buffer size is 0 ("powerpc/papr_scm: don't requests stats with '0' sized stats buffer").
powerpc/papr_scm (drc_pmem_query_stats / papr_scm_probe) stat_buffer_len check = required - Compensating control
If "Enable Performance Information Collection" cannot be changed, avoid triggering papr_scm probing paths that call drc_pmem_query_stats() with size==0 by ensuring the vPMEM/papr_scm performance-stats collection is not requested when NVDIMM performance stats are unsupported (as observed for vPMEM where the NVDIMM doesn't support papr_scm_pmu_check_events()).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2347781?
The severity of REDHAT-BUG-2347781 is critical due to the potential for kernel panic in affected systems.
How do I fix REDHAT-BUG-2347781?
To fix REDHAT-BUG-2347781, apply the latest kernel updates provided by your Linux distribution.
What systems are affected by REDHAT-BUG-2347781?
REDHAT-BUG-2347781 affects Linux kernel versions running on POWER-10 architectures.
What is the impact of REDHAT-BUG-2347781?
The impact of REDHAT-BUG-2347781 includes potential system instability and kernel panics during specific operations.
Who reported REDHAT-BUG-2347781?
REDHAT-BUG-2347781 was reported by Sachin.