CVE-2024-36928

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/qeth: Fix kernel panic after setting hsuid<br /> <br /> Symptom:<br /> When the hsuid attribute is set for the first time on an IQD Layer3<br /> device while the corresponding network interface is already UP,<br /> the kernel will try to execute a napi function pointer that is NULL.<br /> <br /> Example:<br /> ---------------------------------------------------------------------------<br /> [ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP<br /> [ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6<br /> nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de<br /> s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod<br /> qdio ccwgroup pkey zcrypt<br /> [ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1<br /> [ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)<br /> [ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)<br /> [ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3<br /> [ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000<br /> [ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80<br /> [ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8<br /> [ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68<br /> [ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal<br /> &gt;0000000000000002: 0000 illegal<br /> 0000000000000004: 0000 illegal<br /> 0000000000000006: 0000 illegal<br /> 0000000000000008: 0000 illegal<br /> 000000000000000a: 0000 illegal<br /> 000000000000000c: 0000 illegal<br /> 000000000000000e: 0000 illegal<br /> [ 2057.572800] Call Trace:<br /> [ 2057.572801] ([] 0xec639700)<br /> [ 2057.572803] [] net_rx_action+0x2ba/0x398<br /> [ 2057.572809] [] __do_softirq+0x11e/0x3a0<br /> [ 2057.572813] [] do_softirq_own_stack+0x3c/0x58<br /> [ 2057.572817] ([] do_softirq.part.1+0x56/0x60)<br /> [ 2057.572822] [] __local_bh_enable_ip+0x80/0x98<br /> [ 2057.572825] [] __dev_queue_xmit+0x2be/0xd70<br /> [ 2057.572827] [] afiucv_hs_send+0x24e/0x300 [af_iucv]<br /> [ 2057.572830] [] iucv_send_ctrl+0x102/0x138 [af_iucv]<br /> [ 2057.572833] [] iucv_sock_connect+0x37a/0x468 [af_iucv]<br /> [ 2057.572835] [] __sys_connect+0xa0/0xd8<br /> [ 2057.572839] [] sys_socketcall+0x228/0x348<br /> [ 2057.572841] [] system_call+0x2a6/0x2c8<br /> [ 2057.572843] Last Breaking-Event-Address:<br /> [ 2057.572844] [] __napi_poll+0x4c/0x1d8<br /> [ 2057.572846]<br /> [ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt<br /> -------------------------------------------------------------------------------------------<br /> <br /> Analysis:<br /> There is one napi structure per out_q: card-&gt;qdio.out_qs[i].napi<br /> The napi.poll functions are set during qeth_open().<br /> <br /> Since<br /> commit 1cfef80d4c2b ("s390/qeth: Don&amp;#39;t call dev_close/dev_open (DOWN/UP)")<br /> qeth_set_offline()/qeth_set_online() no longer call dev_close()/<br /> dev_open(). So if qeth_free_qdio_queues() cleared<br /> card-&gt;qdio.out_qs[i].napi.poll while the network interface was UP and the<br /> card was offline, they are not set again.<br /> <br /> Reproduction:<br /> chzdev -e $devno layer2=0<br /> ip link set dev $network_interface up<br /> echo 0 &gt; /sys/bus/ccw<br /> ---truncated---