Skip to content

[LTS 7.9] net: mdio: fix undefined behavior in bit shift for __mdiobus_register#374

Merged
PlaidCat merged 1 commit into
ctrliq:ciqcbr7_9from
pvts-mat:ciqcbr7_9-CVE-2022-49907
Jun 30, 2025
Merged

[LTS 7.9] net: mdio: fix undefined behavior in bit shift for __mdiobus_register#374
PlaidCat merged 1 commit into
ctrliq:ciqcbr7_9from
pvts-mat:ciqcbr7_9-CVE-2022-49907

Conversation

@pvts-mat

@pvts-mat pvts-mat commented Jun 26, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

[CBR 7.9]
CVE-2022-49907
VULN-66410

Problem

https://www.cve.org/CVERecord?id=CVE-2022-49907

In the Linux kernel, the following vulnerability has been resolved:

net: mdio: fix undefined behavior in bit shift for __mdiobus_register

Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned. The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27
left shift of 1 by 31 places cannot be represented in type 'int'
Call Trace:
 <TASK>
 dump_stack_lvl+0x7d/0xa5
 dump_stack+0x15/0x1b
 ubsan_epilogue+0xe/0x4e
 __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
 __mdiobus_register+0x49d/0x4e0
 fixed_mdio_bus_init+0xd8/0x12d
 do_one_initcall+0x76/0x430
 kernel_init_freeable+0x3b3/0x422
 kernel_init+0x24/0x1e0
 ret_from_fork+0x1f/0x30
 </TASK>

Applicability: yes (similar as in #358)

The bug applies to CBR 7.9: the affected MDIO bus driver is central to the control of any ethernet interface device. The patch 40e4eb3 is not backported onto CBR 7.9. The commit 4fd5f81 marked in 40e4eb3 as introducing the bug is present in ciqcbr7_9's history.

Solution (same as in #358)

The solution in 40e4eb3 involves using the BIT(i) macro instead of the raw bit shift 1 << i to obtain an int with i -th bit set. The fully expanded BIT(i) macro boils down to 1UL << i construct operating on unsigned type where the left shit is defined for the full range of the type's bits (see include/vdso/bits.h, include/uapi/linux/const.h, include/linux/bits.h).

kABI check: passed

[pvts@ciqcbr-7-9 kernel-dist-git-el-7.9]$ SOURCES/check-kabi -k SOURCES/Module.kabi_x86_64 -s /mnt/build_files/kernel-src-tree-ciqcbr7_9-CVE-2022-49907/Module.symvers
[pvts@ciqcbr-7-9 kernel-dist-git-el-7.9]$ echo $? 

0

Boot test: passed

boot-test.log

Kselftests: passed relative

Reference

kselftests–ciqcbr7_9–run1.log

Patch

kselftests–ciqcbr7_9-CVE-2022-49907–run1.log

Manual comparison

The logs of the CBR 7.9 selftests don't conform to the unified TAP 13 format of the versions ≥ LTS 8.6 and as such they can't be parsed in an automated way. The results must be assessed manually.

The test results for the reference and patched kernel are the same.

  Reference Patch Comment
breakpoints pass pass  
cpu-hotplug unknown result unknown result Neither errors nor explicit "ok" reported
efivarfs skipped skipped Requires some EFI partition to mount
kcmp skipped skipped Unresolved compilation errors
livepatch:test-livepatch.sh skipped skipped Requires CONFIG_TEST_LIVEPATCH option
livepatch:test-callbacks.sh skipped skipped Requires CONFIG_TEST_LIVEPATCH option
livepatch:test-shadow-vars.sh skipped skipped Requires CONFIG_TEST_LIVEPATCH option
livepatch:test-ftrace.sh skipped skipped Requires CONFIG_TEST_LIVEPATCH option
memory-hotplug unknown result unknown result Neither errors nor explicit "ok" reported
mqueue pass pass  
net:run_netsocktests pass pass  
net:run_afpackettests pass pass  
ptrace pass pass  
vm:run_vmtests pass pass  
x86:sigreturn_64 fail fail  
x86:single_step_syscall_64 pass pass  

Specific tests: skipped

@pvts-mat
net: mdio: fix undefined behavior in bit shift for __mdiobus_register
77ffce4 
jira VULN-66410
cve CVE-2022-49907
commit-author Gaosheng Cui <cuigaosheng1@huawei.com>
commit 40e4eb3

Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned. The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27
left shift of 1 by 31 places cannot be represented in type 'int'
Call Trace:
 <TASK>
 dump_stack_lvl+0x7d/0xa5
 dump_stack+0x15/0x1b
 ubsan_epilogue+0xe/0x4e
 __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
 __mdiobus_register+0x49d/0x4e0
 fixed_mdio_bus_init+0xd8/0x12d
 do_one_initcall+0x76/0x430
 kernel_init_freeable+0x3b3/0x422
 kernel_init+0x24/0x1e0
 ret_from_fork+0x1f/0x30
 </TASK>

Fixes: 4fd5f81 ("phylib: allow incremental scanning of an mii bus")
	Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
	Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20221031132645.168421-1-cuigaosheng1@huawei.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 40e4eb3)
	Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
PlaidCat
PlaidCat approved these changes Jun 26, 2025
View reviewed changes

@PlaidCat PlaidCat left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

bmastbergen
bmastbergen approved these changes Jun 26, 2025
View reviewed changes

@bmastbergen bmastbergen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@PlaidCat PlaidCat merged commit ba92bd2 into ctrliq:ciqcbr7_9 Jun 30, 2025
1 check passed
github-actions Bot pushed a commit that referenced this pull request Nov 26, 2025
@Waiman-Long
tools headers UAPI: Sync linux/prctl.h with the kernel sources to pic…
3f82609 
…k FUTEX knob

JIRA: https://issues.redhat.com/browse/RHEL-101509
Conflicts:
  A merge conflict due to missing upstream commit df4bd8c ("tools
  headers: Update the uapi/linux/prctl.h copy with the kernel sources").

commit 3ce66a4
Author: Arnaldo Carvalho de Melo <acme@redhat.com>
Date:   Mon, 9 Jun 2025 15:02:17 -0300

    tools headers UAPI: Sync linux/prctl.h with the kernel sources to pick FUTEX knob

    To pick the changes in:

      63e8595 ("futex: Allow to make the private hash immutable")
      80367ad ("futex: Add basic infrastructure for local task local hash")

    That adds a FUTEX knob:

      $ tools/perf/trace/beauty/prctl_option.sh > before
      $ cp include/uapi/linux/prctl.h tools/perf/trace/beauty/include/uapi/linux/prctl.h
      $ tools/perf/trace/beauty/prctl_option.sh > after
      $ diff -u before after
      --- before    2025-06-09 14:50:45.162579336 -0300
      +++ after     2025-06-09 14:50:52.797660024 -0300
      @@ -72,6 +72,7 @@
            [75] = "SET_SHADOW_STACK_STATUS",
            [76] = "LOCK_SHADOW_STACK_STATUS",
            [77] = "TIMER_CREATE_RESTORE_IDS",
      +     [78] = "FUTEX_HASH",
       };
       static const char *prctl_set_mm_options[] = {
            [1] = "START_CODE",
      $

    That now will be used to decode the syscall option and also to compose
    filters, for instance:

      [root@five ~]# perf trace -e syscalls:sys_enter_prctl --filter option==SET_NAME
           0.000 Isolated Servi/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23f13b7aee)
           0.032 DOM Worker/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23deb25670)
           7.920 :3474328/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fbb10)
           7.935 StreamT~s #374/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fb970)
           8.400 Isolated Servi/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24bab10)
           8.418 StreamT~s #374/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24ba970)
      ^C[root@five ~]#

    This addresses this perf build warning:

      Warning: Kernel ABI header differences:
        diff -u tools/perf/trace/beauty/include/uapi/linux/prctl.h include/uapi/linux/prctl.h

    Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Cc: Adrian Hunter <adrian.hunter@intel.com>
    Cc: Ian Rogers <irogers@google.com>
    Cc: James Clark <james.clark@linaro.org>
    Cc: Jiri Olsa <jolsa@kernel.org>
    Cc: Kan Liang <kan.liang@linux.intel.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: https://lore.kernel.org/r/aEiYOtKkrVDT03hZ@x1
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Signed-off-by: Waiman Long <longman@redhat.com>
github-actions Bot pushed a commit that referenced this pull request Nov 29, 2025
@Waiman-Long
tools headers UAPI: Sync linux/prctl.h with the kernel sources to pic…
8cbef7f 
…k FUTEX knob

JIRA: https://issues.redhat.com/browse/RHEL-101190
Conflicts:
  A context diff due to missing upstream commit df4bd8c ("tools
  headers: Update the uapi/linux/prctl.h copy with the kernel sources").

commit 3ce66a4
Author: Arnaldo Carvalho de Melo <acme@redhat.com>
Date:   Mon, 9 Jun 2025 15:02:17 -0300

    tools headers UAPI: Sync linux/prctl.h with the kernel sources to pick FUTEX knob

    To pick the changes in:

      63e8595 ("futex: Allow to make the private hash immutable")
      80367ad ("futex: Add basic infrastructure for local task local hash")

    That adds a FUTEX knob:

      $ tools/perf/trace/beauty/prctl_option.sh > before
      $ cp include/uapi/linux/prctl.h tools/perf/trace/beauty/include/uapi/linux/prctl.h
      $ tools/perf/trace/beauty/prctl_option.sh > after
      $ diff -u before after
      --- before    2025-06-09 14:50:45.162579336 -0300
      +++ after     2025-06-09 14:50:52.797660024 -0300
      @@ -72,6 +72,7 @@
            [75] = "SET_SHADOW_STACK_STATUS",
            [76] = "LOCK_SHADOW_STACK_STATUS",
            [77] = "TIMER_CREATE_RESTORE_IDS",
      +     [78] = "FUTEX_HASH",
       };
       static const char *prctl_set_mm_options[] = {
            [1] = "START_CODE",
      $

    That now will be used to decode the syscall option and also to compose
    filters, for instance:

      [root@five ~]# perf trace -e syscalls:sys_enter_prctl --filter option==SET_NAME
           0.000 Isolated Servi/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23f13b7aee)
           0.032 DOM Worker/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23deb25670)
           7.920 :3474328/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fbb10)
           7.935 StreamT~s #374/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fb970)
           8.400 Isolated Servi/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24bab10)
           8.418 StreamT~s #374/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24ba970)
      ^C[root@five ~]#

    This addresses this perf build warning:

      Warning: Kernel ABI header differences:
        diff -u tools/perf/trace/beauty/include/uapi/linux/prctl.h include/uapi/linux/prctl.h

    Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Cc: Adrian Hunter <adrian.hunter@intel.com>
    Cc: Ian Rogers <irogers@google.com>
    Cc: James Clark <james.clark@linaro.org>
    Cc: Jiri Olsa <jolsa@kernel.org>
    Cc: Kan Liang <kan.liang@linux.intel.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: https://lore.kernel.org/r/aEiYOtKkrVDT03hZ@x1
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Signed-off-by: Waiman Long <longman@redhat.com>
github-actions Bot pushed a commit that referenced this pull request Mar 14, 2026
@acmel
tools headers: Sync uapi/linux/prctl.h with the kernel source
cfdf645 
To pick up the changes in these csets:

  5ca243f ("prctl: add arch-agnostic prctl()s for indirect branch tracking")
  28621ec ("rseq: Add prctl() to enable time slice extensions")

That don't introduced these new prctls:

  $ tools/perf/trace/beauty/prctl_option.sh > before.txt
  $ cp include/uapi/linux/prctl.h tools/perf/trace/beauty/include/uapi/linux/prctl.h
  $ tools/perf/trace/beauty/prctl_option.sh > after.txt
  $ diff -u before.txt after.txt
  --- before.txt	2026-02-27 09:07:16.435611457 -0300
  +++ after.txt	2026-02-27 09:07:28.189816531 -0300
  @@ -73,6 +73,10 @@
   	[76] = "LOCK_SHADOW_STACK_STATUS",
   	[77] = "TIMER_CREATE_RESTORE_IDS",
   	[78] = "FUTEX_HASH",
  +	[79] = "RSEQ_SLICE_EXTENSION",
  +	[80] = "GET_INDIR_BR_LP_STATUS",
  +	[81] = "SET_INDIR_BR_LP_STATUS",
  +	[82] = "LOCK_INDIR_BR_LP_STATUS",
   };
   static const char *prctl_set_mm_options[] = {
   	[1] = "START_CODE",
  $

That now will be used to decode the syscall option and also to compose
filters, for instance:

  [root@five ~]# perf trace -e syscalls:sys_enter_prctl --filter option==SET_NAME
       0.000 Isolated Servi/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23f13b7aee)
       0.032 DOM Worker/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23deb25670)
       7.920 :3474328/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fbb10)
       7.935 StreamT~s #374/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fb970)
       8.400 Isolated Servi/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24bab10)
       8.418 StreamT~s #374/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24ba970)
  ^C[root@five ~]#

This addresses these perf build warnings:

  Warning: Kernel ABI header differences:
    diff -u tools/perf/trace/beauty/include/uapi/linux/prctl.h include/uapi/linux/prctl.h

Please see tools/include/uapi/README for further details.

Cc: Deepak Gupta <debug@rivosinc.com>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
github-actions Bot pushed a commit that referenced this pull request Apr 20, 2026
@apopple-nvidia @akpm00
lib: test_hmm: implement a device release method
af69016 
Unloading the HMM test module produces the following warning:

[ 3782.224783] ------------[ cut here ]------------
[ 3782.226323] Device 'hmm_dmirror0' does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst.
[ 3782.230570] WARNING: drivers/base/core.c:2567 at device_release+0x185/0x210, CPU#20: rmmod/1924
[ 3782.233949] Modules linked in: test_hmm(-) nvidia_uvm(O) nvidia(O)
[ 3782.236321] CPU: 20 UID: 0 PID: 1924 Comm: rmmod Tainted: G           O        7.0.0-rc1+ #374 PREEMPT(full)
[ 3782.240226] Tainted: [O]=OOT_MODULE
[ 3782.241639] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[ 3782.246193] RIP: 0010:device_release+0x185/0x210
[ 3782.247860] Code: 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 86 00 00 00 48 8b 73 50 48 85 f6 74 11 48 8d 3d db 25 29 03 <67> 48 0f b9 3a e9 0d ff ff ff 48 b8 00 00 00 00 00 fc ff df 48 89
[ 3782.254211] RSP: 0018:ffff888126577d98 EFLAGS: 00010246
[ 3782.256054] RAX: dffffc0000000000 RBX: ffffffffc2b70310 RCX: ffffffff8fe61ba1
[ 3782.258512] RDX: 1ffffffff856e062 RSI: ffff88811341eea0 RDI: ffffffff91bbacb0
[ 3782.261041] RBP: ffff888111475000 R08: 0000000000000001 R09: fffffbfff856e069
[ 3782.263471] R10: ffffffffc2b7034b R11: 00000000ffffffff R12: 0000000000000000
[ 3782.265983] R13: dffffc0000000000 R14: ffff88811341eea0 R15: 0000000000000000
[ 3782.268443] FS:  00007fd5a3689040(0000) GS:ffff88842c8d0000(0000) knlGS:0000000000000000
[ 3782.271236] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3782.273251] CR2: 00007fd5a36d2c10 CR3: 00000001242b8000 CR4: 00000000000006f0
[ 3782.275362] Call Trace:
[ 3782.276071]  <TASK>
[ 3782.276678]  kobject_put+0x146/0x270
[ 3782.277731]  hmm_dmirror_exit+0x7a/0x130 [test_hmm]
[ 3782.279135]  __do_sys_delete_module+0x341/0x510
[ 3782.280438]  ? module_flags+0x300/0x300
[ 3782.281547]  do_syscall_64+0x111/0x670
[ 3782.282620]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 3782.284091] RIP: 0033:0x7fd5a3793b37
[ 3782.285303] Code: 73 01 c3 48 8b 0d c9 82 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 99 82 0c 00 f7 d8 64 89 01 48
[ 3782.290708] RSP: 002b:00007ffd68b7dc68 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[ 3782.292817] RAX: ffffffffffffffda RBX: 000055e3c0d1c770 RCX: 00007fd5a3793b37
[ 3782.294735] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055e3c0d1c7d8
[ 3782.296661] RBP: 0000000000000000 R08: 1999999999999999 R09: 0000000000000000
[ 3782.298622] R10: 00007fd5a3806ac0 R11: 0000000000000206 R12: 00007ffd68b7deb0
[ 3782.300576] R13: 00007ffd68b7e781 R14: 000055e3c0d1b2a0 R15: 00007ffd68b7deb8
[ 3782.301963]  </TASK>
[ 3782.302371] irq event stamp: 5019
[ 3782.302987] hardirqs last  enabled at (5027): [<ffffffff8cf1f062>] __up_console_sem+0x52/0x60
[ 3782.304507] hardirqs last disabled at (5036): [<ffffffff8cf1f047>] __up_console_sem+0x37/0x60
[ 3782.306086] softirqs last  enabled at (4940): [<ffffffff8cd9a4b0>] __irq_exit_rcu+0xc0/0xf0
[ 3782.307567] softirqs last disabled at (4929): [<ffffffff8cd9a4b0>] __irq_exit_rcu+0xc0/0xf0
[ 3782.309105] ---[ end trace 0000000000000000 ]---

This is because the test module doesn't have a device.release method.  In
this case one probably isn't needed for correctness - the device structs
are in a static array so don't need freeing when the final reference goes
away.

However some device state is freed on exit, so to ensure this happens at
the right time and to silence the warning move the deinitialisation to a
release method and assign that as the device release callback.  Whilst
here also fix a minor error handling bug where cdev_device_del() wasn't
being called if allocation failed.

Link: https://lore.kernel.org/20260331063445.3551404-4-apopple@nvidia.com
Fixes: 6a760f5 ("mm/hmm/test: use char dev with struct device to get device node")
Signed-off-by: Alistair Popple <apopple@nvidia.com>
Acked-by: Balbir Singh <balbirs@nvidia.com>
Tested-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: <stable@vger,kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PlaidCat PlaidCat PlaidCat approved these changes
@bmastbergen bmastbergen bmastbergen approved these changes
@kerneltoast kerneltoast Awaiting requested review from kerneltoast
@thefossguy-ciq thefossguy-ciq Awaiting requested review from thefossguy-ciq

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@pvts-mat @PlaidCat @bmastbergen