CVE: CVE-2024-35911
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: fix memory corruption bug with suspend and rebuild

The ice driver would previously panic after suspend. This is caused
from the driver *only* calling the ice_vsi_free_q_vectors() function by
itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent
NULL pointer deref during reload") the driver has zeroed out
num_q_vectors, and only restored it in ice_vsi_cfg_def().

This further causes the ice_rebuild() function to allocate a zero length
buffer, after which num_q_vectors is updated, and then the new value of
num_q_vectors is used to index into the zero length buffer, which
corrupts memory.

The fix entails making sure all the code referencing num_q_vectors only
does so after it has been reset via ice_vsi_cfg_def().

I didn't perform a full bisect, but I was able to test against 6.1.77
kernel and that ice driver works fine for suspend/resume with no panic,
so sometime since then, this problem was introduced.

Also clean up an un-needed init of a local variable in the function
being modified.

PANIC from 6.8.0-rc1:

[[PII_REDACTED]96] PM: suspend exit
[[PII_REDACTED]97] ice 0000:17:00.1: PTP reset successful
[[PII_REDACTED]07] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time
[[PII_REDACTED]60] ice 0000:b1:00.0: PTP reset successful
[[PII_REDACTED]44] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time
[[PII_REDACTED]33] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None
[[PII_REDACTED]01] BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
[[PII_REDACTED]53] ice 0000:17:00.0: PTP reset successful
[[PII_REDACTED]64] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time
[[PII_REDACTED]28] #PF: supervisor read access in kernel mode
[[PII_REDACTED]33] #PF: error_code(0x0000) - not-present page
[[PII_REDACTED]37] PGD 1557a7067 P4D 0
[[PII_REDACTED]33] ice 0000:b1:00.1: PTP reset successful
[[PII_REDACTED]43] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time
[[PII_REDACTED]75]
[[PII_REDACTED]42] Oops: 0000 [#1] PREEMPT SMP NOPTI
[[PII_REDACTED]18] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G        W          6.8.0-rc1+ #1
[[PII_REDACTED]89] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0[PII_REDACTED]810 02/16/2022
[[PII_REDACTED]67] Workqueue: ice ice_service_task [ice]
[[PII_REDACTED]92] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]
[[PII_REDACTED]21] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6
[[PII_REDACTED]77] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202
[[PII_REDACTED]56] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: [PII_REDACTED]
[[PII_REDACTED]48] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ff28691e41099828
[[PII_REDACTED]30] RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
[[PII_REDACTED]11] R10: [PII_REDACTED] R11: ffffffffffffffc0 R12: [PII_REDACTED]
[[PII_REDACTED]96] R13: [PII_REDACTED] R14: [PII_REDACTED] R15: ff28691e0eaa81a0
[[PII_REDACTED]72] FS:  [PII_REDACTED](0000) GS:ff28693cbffc0000(0000) knlGS:[PII_REDACTED]
[[PII_REDACTED]00] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[[PII_REDACTED]95] CR2: [PII_REDACTED] CR3:[PII_REDACTED]df4001 CR4:[PII_REDACTED]771ef0
[[PII_REDACTED]79] DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
[[PII_REDACTED]69] DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
[[PII_REDACTED]52] PKRU: 55555554
[[PII_REDACTED]16] Call Trace:
[[PII_REDACTED]23]  <TASK>
[[PII_REDACTED]89]  ? __die+0x20/0x70
[[PII_REDACTED]05]  ? page_fault_oops+0x82/0x160
[[PII_REDACTED]76]  ? do_user_addr_fault+0x65/0x6a0
[[PII_REDACTED]07]  ? exc_page_fault+0x6a/0x150
[[PII_REDACTED]94]  ? asm_exc_page_fault+0x22/0x30
[[PII_REDACTED]49]  ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]
[[PII_REDACTED]
---truncated---
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170; https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba[PII_REDACTED]; https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec