Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]net: dsa: felix: suppress non-changes to the tagging protocol[EOL][EOL]The way in which dsa_tree_change_tag_proto() works is that when[EOL]dsa_tree_notify() fails, it doesn't know whether the operation failed[EOL]mid way in a multi-switch tree, or it failed for a single-switch tree.[EOL]So even though drivers need to fail cleanly in[EOL]ds->ops->change_tag_protocol(), DSA will still call dsa_tree_notify()[EOL]again, to restore the old tag protocol for potential switches in the[EOL]tree where the change did succeeed (before failing for others).[EOL][EOL]This means for the felix driver that if we report an error in[EOL]felix_change_tag_protocol(), we'll get another call where proto_ops ==[EOL]old_proto_ops. If we proceed to act upon that, we may do unexpected[EOL]things. For example, we will call dsa_tag_8021q_register() twice in a[EOL]row, without any dsa_tag_8021q_unregister() in between. Then we will[EOL]actually call dsa_tag_8021q_unregister() via old_proto_ops->teardown,[EOL]which (if it manages to run at all, after walking through corrupted data[EOL]structures) will leave the ports inoperational anyway.[EOL][EOL]The bug can be readily reproduced if we force an error while in[EOL]tag_8021q mode; this crashes the kernel.[EOL][EOL]echo ocelot-8021q > /sys/class/net/eno2/dsa/tagging[EOL]echo edsa > /sys/class/net/eno2/dsa/tagging # -EPROTONOSUPPORT[EOL][EOL]Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014[EOL]Call trace:[EOL] vcap_entry_get+0x24/0x124[EOL] ocelot_vcap_filter_del+0x198/0x270[EOL] felix_tag_8021q_vlan_del+0xd4/0x21c[EOL] dsa_switch_tag_8021q_vlan_del+0x168/0x2cc[EOL] dsa_switch_event+0x68/0x1170[EOL] dsa_tree_notify+0x14/0x34[EOL] dsa_port_tag_8021q_vlan_del+0x84/0x110[EOL] dsa_tag_8021q_unregister+0x15c/0x1c0[EOL] felix_tag_8021q_teardown+0x16c/0x180[EOL] felix_change_tag_protocol+0x1bc/0x230[EOL] dsa_switch_event+0x14c/0x1170[EOL] dsa_tree_change_tag_proto+0x118/0x1c0

CREATE(Triage):(User=lchen-cn) [CVE-2022-50063 (https://nvd.nist.gov/vuln/detail/CVE-2022-50063)