CVE: CVE-2021-47023
Published: 2024-02-28
Description: In the Linux kernel, the following vulnerability has been resolved:

net: marvell: prestera: fix port event handling on init

For some reason there might be a crash during ports creation if port
events are handling at the same time  because fw may send initial
port event with down state.

The crash points to cancel_delayed_work() which is called when port went
is down.  Currently I did not find out the real cause of the issue, so
fixed it by cancel port stats work only if previous port's state was up
& runnig.

The following is the crash which can be triggered:

[   28.311104] Unable to handle kernel paging request at virtual address
000071775f776600
[   28.319097] Mem abort info:
[   28.321914]   ESR = 0x96000004
[   28.324996]   EC = 0x25: DABT (current EL), IL = 32 bits
[   28.330350]   SET = 0, FnV = 0
[   28.333430]   EA = 0, S1PTW = 0
[   28.336597] Data abort info:
[   28.339499]   ISV = 0, ISS = 0x00000004
[   28.343362]   CM = 0, WnR = 0
[   28.346354] user pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]bf7000
[   28.352842] [000071775f776600] pgd=[PII_REDACTED],
p4d=[PII_REDACTED]
[   28.359695] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[   28.365310] Modules linked in: prestera_pci(+) prestera
uio_pdrv_genirq
[   28.372005] CPU: 0 PID: 1291 Comm: kworker/0:1H Not tainted
5.11.0-rc4 #1
[   28.378846] Hardware name: DNI AmazonGo1 A7040 board (DT)
[   28.384283] Workqueue: prestera_fw_wq prestera_fw_evt_work_fn
[prestera_pci]
[   28.391413] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--)
[   28.397468] pc : get_work_pool+0x48/0x60
[   28.401442] lr : try_to_grab_pending+0x6c/0x1b0
[   28.406018] sp : ffff80001391bc60
[   28.409358] x29: ffff80001391bc60 x28: [PII_REDACTED]
[   28.414725] x27: ffff000104fc8b40 x26: ffff80001127de88
[   28.420089] x25: [PII_REDACTED] x24: ffff[PII_REDACTED]60
[   28.425452] x23: ffff00010775dd60 x22: ffff00010567e000
[   28.430814] x21: [PII_REDACTED] x20: ffff80001391bcb0
[   28.436175] x19: ffff00010775deb8 x18:[PII_REDACTED]0000c0
[   28.441537] x17: [PII_REDACTED] x16: 000000008d9b0e88
[   28.446898] x15: [PII_REDACTED] x14:[PII_REDACTED]0002ba
[   28.452261] x13: 80a3002c00000002 x12:[PII_REDACTED]0005f4
[   28.457622] x11: [PII_REDACTED] x10:[PII_REDACTED]00000c
[   28.462985] x9 :[PII_REDACTED]00000c x8 : [PII_REDACTED]
[   28.468346] x7 : ffff[PII_REDACTED]00 x6 : ffff[PII_REDACTED]58
[   28.473708] x5 : [PII_REDACTED] x4 : ffff00010775dc60
[   28.479068] x3 : [PII_REDACTED] x2 : [PII_REDACTED]
[   28.484429] x1 : 000071775f776600 x0 : ffff00010775deb8
[   28.489791] Call trace:
[   28.492259]  get_work_pool+0x48/0x60
[   28.495874]  cancel_delayed_work+0x38/0xb0
[   28.500011]  prestera_port_handle_event+0x90/0xa0 [prestera]
[   28.505743]  prestera_evt_recv+0x98/0xe0 [prestera]
[   28.510683]  prestera_fw_evt_work_fn+0x180/0x228 [prestera_pci]
[   28.516660]  process_one_work+0x1e8/0x360
[   28.520710]  worker_thread+0x44/0x480
[   28.524412]  kthread+0x154/0x160
[   28.527670]  ret_from_fork+0x10/0x38
[   28.531290] Code: a8c17bfd d50323bf d65f03c0 9278dc21 (f9400020)
[   28.537429] ---[ end trace 5eced933df3a080b ]---
CVSS Score: 8.2 (HIGH)
CWE: CWE-400
References: https://git.kernel.org/stable/c/0ce6052802be2cb61a57b753e41301339c88c839; https://git.kernel.org/stable/c/333980481b99edb24ebd5d1a53af70a15d9146de; https://git.kernel.org/stable/c/9d1ba11fabdd8f25abb24272ef[PII_REDACTED]20b