CVE: CVE-2024-36928
Published: 2024-05-30
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/qeth: Fix kernel panic after setting hsuid

Symptom:
When the hsuid attribute is set for the first time on an IQD Layer3
device while the corresponding network interface is already UP,
the kernel will try to execute a napi function pointer that is NULL.

Example:
---------------------------------------------------------------------------
[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP
[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6
nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de
s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod
 qdio ccwgroup pkey zcrypt
[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1
[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)
[ 2057.572744] Krnl PSW : 0704f[PII_REDACTED]0 [PII_REDACTED] (0x2)
[ 2057.572748]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
[ 2057.572751] Krnl GPRS: [PII_REDACTED] [PII_REDACTED] 00000000a3b008d8 [PII_REDACTED]
[ 2057.572754]            00000000a3b008d8 cb923a29c779abc5 [PII_REDACTED][PII_REDACTED]4cfd80
[ 2057.572756]           [PII_REDACTED]00012c [PII_REDACTED] 00000000a3b008d8 00000000a3b008d8
[ 2057.572758]            00000000bab6d[PII_REDACTED]0814cfd80[PII_REDACTED]317e46[PII_REDACTED]4cfc68
[ 2057.572762] Krnl Code:#[PII_REDACTED]: 0000                illegal
                         >[PII_REDACTED]: 0000                illegal
                          [PII_REDACTED]: 0000                illegal
                          [PII_REDACTED]: 0000                illegal
                          [PII_REDACTED]: 0000                illegal
                         [PII_REDACTED]00000a: 0000                illegal
                         [PII_REDACTED]00000c: 0000                illegal
                         [PII_REDACTED]00000e: 0000                illegal
[ 2057.572800] Call Trace:
[ 2057.572801] ([<00000000ec639700>] 0xec639700)
[ 2057.572803]  [<[PII_REDACTED]3183e2>] net_rx_action+0x2ba/0x398
[ 2057.572809]  [<[PII_REDACTED]515f76>] __do_softirq+0x11e/0x3a0
[ 2057.572813]  [<[PII_REDACTED]ce160c>] do_softirq_own_stack+0x3c/0x58
[ 2057.572817] ([<[PII_REDACTED]d2cbd6>] do_softirq.part.1+0x56/0x60)
[ 2057.572822]  [<[PII_REDACTED]d2cc60>] __local_bh_enable_ip+0x80/0x98
[ 2057.572825]  [<[PII_REDACTED]>] __dev_queue_xmit+0x2be/0xd70
[ 2057.572827]  [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv]
[ 2057.572830]  [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv]
[ 2057.572833]  [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv]
[ 2057.572835]  [<[PII_REDACTED]2e7e90>] __sys_connect+0xa0/0xd8
[ 2057.572839]  [<[PII_REDACTED]2e9580>] sys_socketcall+0x228/0x348
[ 2057.572841]  [<[PII_REDACTED]514e1a>] system_call+0x2a6/0x2c8
[ 2057.572843] Last Breaking-Event-Address:
[ 2057.572844]  [<[PII_REDACTED]317e44>] __napi_poll+0x4c/0x1d8
[ 2057.572846]
[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt
-------------------------------------------------------------------------------------------

Analysis:
There is one napi structure per out_q: card->qdio.out_qs[i].napi
The napi.poll functions are set during qeth_open().

Since
commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)")
qeth_set_offline()/qeth_set_online() no longer call dev_close()/
dev_open(). So if qeth_free_qdio_queues() cleared
card->qdio.out_qs[i].napi.poll while the network interface was UP and the
card was offline, they are not set again.

Reproduction:
chzdev -e $devno layer2=0
ip link set dev $network_interface up
echo 0 > /sys/bus/ccw
---truncated---
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6; https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524; https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494