CVE: CVE-2022-48795
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

parisc: Fix data TLB miss in sba_unmap_sg

Rolf Eike Beer reported the following bug:

[[PII_REDACTED]91] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr [PII_REDACTED]
[[PII_REDACTED]91] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4
[[PII_REDACTED]91] Hardware name: 9000/785/C8000
[[PII_REDACTED]91]
[[PII_REDACTED]91]      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
[[PII_REDACTED]91] PSW:[PII_REDACTED][PII_REDACTED][PII_REDACTED]0 Not tainted
[[PII_REDACTED]91] r00-03  000000ff0804fe0e[PII_REDACTED]bc9bc0[PII_REDACTED]6760e4 [PII_REDACTED]
[[PII_REDACTED]91] r04-07 [PII_REDACTED]b693c0 [PII_REDACTED] 000000004a2b08b0 [PII_REDACTED]
[[PII_REDACTED]91] r08-11 [PII_REDACTED]f98810 [PII_REDACTED] 000000004a0a7000 [PII_REDACTED]
[[PII_REDACTED]91] r12-15 [PII_REDACTED]bddbc0[PII_REDACTED]c0cbc0[PII_REDACTED]bddbc0[PII_REDACTED]bddbc0
[[PII_REDACTED]91] r16-19 [PII_REDACTED]bde3c0[PII_REDACTED]bddbc0[PII_REDACTED]bde3c0 [PII_REDACTED]
[[PII_REDACTED]91] r20-23  [PII_REDACTED] 000000004a368950 [PII_REDACTED] [PII_REDACTED]
[[PII_REDACTED]91] r24-27 [PII_REDACTED]001fff[PII_REDACTED]00000e 000000004a1710f0[PII_REDACTED]b693c0
[[PII_REDACTED]91] r28-31  [PII_REDACTED][PII_REDACTED]f988b0[PII_REDACTED]f98[PII_REDACTED]04a171118
[[PII_REDACTED]91] sr00-03 [PII_REDACTED]6e5800 [PII_REDACTED] [PII_REDACTED][PII_REDACTED]6e5800
[[PII_REDACTED]91] sr04-07  [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
[[PII_REDACTED]91]
[[PII_REDACTED]91] IASQ: [PII_REDACTED] [PII_REDACTED] IAOQ:[PII_REDACTED]6760e8[PII_REDACTED]6760ec
[[PII_REDACTED]91]  IIR: 48780030    ISR: [PII_REDACTED]  IOR: [PII_REDACTED]
[[PII_REDACTED]91]  CPU:        3   CR30: 00000040e3a9c000 CR31: ffffffffffffffff
[[PII_REDACTED]91]  ORIG_R28:[PII_REDACTED]acdd58
[[PII_REDACTED]91]  IAOQ[0]: sba_unmap_sg+0xb0/0x118
[[PII_REDACTED]91]  IAOQ[1]: sba_unmap_sg+0xb4/0x118
[[PII_REDACTED]91]  RP(r2): sba_unmap_sg+0xac/0x118
[[PII_REDACTED]91] Backtrace:
[[PII_REDACTED]91]  [<[PII_REDACTED]2740cc>] dma_unmap_sg_attrs+0x6c/0x70
[[PII_REDACTED]91]  [<[PII_REDACTED]74d6bc>] scsi_dma_unmap+0x54/0x60
[[PII_REDACTED]91]  [<[PII_REDACTED]7a3488>] mptscsih_io_done+0x150/0xd70
[[PII_REDACTED]91]  [<[PII_REDACTED]>] mpt_interrupt+0x168/0xa68
[[PII_REDACTED]91]  [<[PII_REDACTED]255a48>] __handle_irq_event_percpu+0xc8/0x278
[[PII_REDACTED]91]  [<[PII_REDACTED]255c34>] handle_irq_event_percpu+0x3c/0xd8
[[PII_REDACTED]91]  [<[PII_REDACTED]25ecb4>] handle_percpu_irq+0xb4/0xf0
[[PII_REDACTED]91]  [<[PII_REDACTED]2548e0>] generic_handle_irq+0x50/0x70
[[PII_REDACTED]91]  [<[PII_REDACTED]19a254>] call_on_stack+0x18/0x24
[[PII_REDACTED]91]
[[PII_REDACTED]91] Kernel panic - not syncing: Bad Address (null pointer deref?)

The bug is caused by overrunning the sglist and incorrectly testing
sg_dma_len(sglist) before nents. Normally this doesn't cause a crash,
but in this case sglist crossed a page boundary. This occurs in the
following code:

	while (sg_dma_len(sglist) && nents--) {

The fix is simply to test nents first and move the decrement of nents
into the loop.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/867e50231c7605547d9334904d70a181f39f2d9e; https://git.kernel.org/stable/c/8c8e949ae81e7f5ab58f9f9f8e9b573b93173dd2; https://git.kernel.org/stable/c/b7d6f44a0fa716a[PII_REDACTED]6dc0b16bc7cd514