In the Linux kernel, the following vulnerability has been resolved:

ARM: davinci: da850-evm: Avoid NULL pointer dereference

With newer versions of GCC, there is a panic in da850evmconfigemac() when booting multiv5defconfig in QEMU under the palmetto-bmc machine:

Unable to handle kernel NULL pointer dereference at virtual address 00000020 pgd = (ptrval) [00000020] pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 Hardware name: Generic DT based system PC is at da850evmconfigemac+0x1c/0x120 LR is at dooneinitcall+0x50/0x1e0

The emacpdata pointer in socinfo is NULL because davincisocinfo only gets populated on davinci machines but da850evmconfigemac() is called on all machines via deviceinitcall().

Move the rmiien assignment below the machine check so that it is only dereferenced when running on a supported SoC.

It was reported that drivers/infiniband stack uses write() as a replacement for bi-directional ioctl(), which is not safe. There are ways to trigger write calls that result in the return structure that is normally written to user space being shunted off to user specified kernel memory instead.

A local unprivileged user on a system with rdmaucm module loaded could use this flaw to escalate their privileges.

Upstream patch:

https://git.kernel.org/linus/e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3

CVE-ID request and assignment:

http://seclists.org/oss-sec/2016/q2/269 http://seclists.org/oss-sec/2016/q2/274