CVE-2024-44976

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ata: pata_macio: Fix DMA table overflow<br /> <br /> Kolbjørn and Jonáš reported that their 32-bit PowerMacs were crashing<br /> in pata-macio since commit 09fe2bfa6b83 ("ata: pata_macio: Fix<br /> max_segment_size with PAGE_SIZE == 64K").<br /> <br /> For example:<br /> <br /> kernel BUG at drivers/ata/pata_macio.c:544!<br /> Oops: Exception in kernel mode, sig: 5 [#1]<br /> BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 DEBUG_PAGEALLOC PowerMac<br /> ...<br /> NIP pata_macio_qc_prep+0xf4/0x190<br /> LR pata_macio_qc_prep+0xfc/0x190<br /> Call Trace:<br /> 0xc1421660 (unreliable)<br /> ata_qc_issue+0x14c/0x2d4<br /> __ata_scsi_queuecmd+0x200/0x53c<br /> ata_scsi_queuecmd+0x50/0xe0<br /> scsi_queue_rq+0x788/0xb1c<br /> __blk_mq_issue_directly+0x58/0xf4<br /> blk_mq_plug_issue_direct+0x8c/0x1b4<br /> blk_mq_flush_plug_list.part.0+0x584/0x5e0<br /> __blk_flush_plug+0xf8/0x194<br /> __submit_bio+0x1b8/0x2e0<br /> submit_bio_noacct_nocheck+0x230/0x304<br /> btrfs_work_helper+0x200/0x338<br /> process_one_work+0x1a8/0x338<br /> worker_thread+0x364/0x4c0<br /> kthread+0x100/0x104<br /> start_kernel_thread+0x10/0x14<br /> <br /> That commit increased max_segment_size to 64KB, with the justification<br /> that the SCSI core was already using that size when PAGE_SIZE == 64KB,<br /> and that there was existing logic to split over-sized requests.<br /> <br /> However with a sufficiently large request, the splitting logic causes<br /> each sg to be split into two commands in the DMA table, leading to<br /> overflow of the DMA table, triggering the BUG_ON().<br /> <br /> With default settings the bug doesn&amp;#39;t trigger, because the request size<br /> is limited by max_sectors_kb == 1280, however max_sectors_kb can be<br /> increased, and apparently some distros do that by default using udev<br /> rules.<br /> <br /> Fix the bug for 4KB kernels by reverting to the old max_segment_size.<br /> <br /> For 64KB kernels the sg_tablesize needs to be halved, to allow for the<br /> possibility that each sg will be split into two.