CVE: CVE-2022-49440
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: Keep MSR[RI] set when calling RTAS

RTAS runs in real mode (MSR[DR] and MSR[IR] unset) and in 32-bit big
endian mode (MSR[SF,LE] unset).

The change in MSR is done in enter_rtas() in a relatively complex way,
since the MSR value could be hardcoded.

Furthermore, a panic has been reported when hitting the watchdog interrupt
while running in RTAS, this leads to the following stack trace:

  watchdog: CPU 24 Hard LOCKUP
  watchdog: CPU 24 TB:[PII_REDACTED]51031, last heartbeat TB:[PII_REDACTED]75378 (15980ms ago)
  ...
  Supported: No, Unreleased kernel
  CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G            E  X    5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c
  NIP:  000000001fb41050 LR: 000000001fb4104c CTR: [PII_REDACTED]
  REGS: c00000000fc33d60 TRAP: 0100   Tainted: G            E  X     (5.14.21-150400.71.1.bz196362_2-default)
  MSR:  [PII_REDACTED] <SF,VEC,VSX,ME>  CR: 48800002  XER: 20040020
  CFAR:[PII_REDACTED]00011c IRQMASK: 1
  GPR00: [PII_REDACTED] ffffffffffffffff [PII_REDACTED][PII_REDACTED]0050dc
  GPR04: 000000001ffb6100 [PII_REDACTED] [PII_REDACTED] 000000001fb09010
  GPR08: [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
  GPR12:[PII_REDACTED]2a40a8 c00000000ff8b680 [PII_REDACTED] [PII_REDACTED]
  GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008
  GPR20: 000000001fb41018 ffffffffffffffff[PII_REDACTED]00017f fffffffffffff68f
  GPR24: 000000001fb18fe8 000000001fb3e[PII_REDACTED]01fb1adc0 000000001fb1cf40
  GPR28: 000000001fb26[PII_REDACTED]01fb460f0 000000001fb17f18 000000001fb17000
  NIP [000000001fb41050] 0x1fb41050
  LR [000000001fb4104c] 0x1fb4104c
  Call Trace:
  Instruction dump:
  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
  Oops: Unrecoverable System Reset, sig: 6 [#1]
  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
  ...
  Supported: No, Unreleased kernel
  CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G            E  X    5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c
  NIP:  000000001fb41050 LR: 000000001fb4104c CTR: [PII_REDACTED]
  REGS: c00000000fc33d60 TRAP: 0100   Tainted: G            E  X     (5.14.21-150400.71.1.bz196362_2-default)
  MSR:  [PII_REDACTED] <SF,VEC,VSX,ME>  CR: 48800002  XER: 20040020
  CFAR:[PII_REDACTED]00011c IRQMASK: 1
  GPR00: [PII_REDACTED] ffffffffffffffff [PII_REDACTED][PII_REDACTED]0050dc
  GPR04: 000000001ffb6100 [PII_REDACTED] [PII_REDACTED] 000000001fb09010
  GPR08: [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
  GPR12:[PII_REDACTED]2a40a8 c00000000ff8b680 [PII_REDACTED] [PII_REDACTED]
  GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008
  GPR20: 000000001fb41018 ffffffffffffffff[PII_REDACTED]00017f fffffffffffff68f
  GPR24: 000000001fb18fe8 000000001fb3e[PII_REDACTED]01fb1adc0 000000001fb1cf40
  GPR28: 000000001fb26[PII_REDACTED]01fb460f0 000000001fb17f18 000000001fb17000
  NIP [000000001fb41050] 0x1fb41050
  LR [000000001fb4104c] 0x1fb4104c
  Call Trace:
  Instruction dump:
  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
  ---[ end trace 3ddec07f638c34a2 ]---

This happens because MSR[RI] is unset when entering RTAS but there is no
valid reason to not set it here.

RTAS is expected to be called with MSR[RI] as specified in PAPR+ section
"7.2.1 Machine State":

  R1–7.2.1–9. If called with MSR[RI] equal to 1, then RTAS must protect
  its own critical regions from recursion by setting the MSR[RI] bit to
  0 when in the critical regions.

Fixing this by reviewing the way MSR is compute before calling RTAS. Now a
hardcoded value meaning real 
---truncated---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d; https://git.kernel.org/stable/c/5f4367448f6817c8a0e94dc9736ed84fa8eee4a3; https://git.kernel.org/stable/c/b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5