In the Linux kernel, the following vulnerability has been resolved:
net: enetc: deny offload of tc-based TSN features on VF interfaces
TSN features on the ENETC (taprio, cbs, gate, police) are configured through a mix of command BD ring messages and port registers: enetcportrd(), enetcportwr().
Port registers are a region of the ENETC memory map which are only accessible from the PCIe Physical Function. They are not accessible from the Virtual Functions.
Moreover, attempting to access these registers crashes the kernel:
$ echo 1 > /sys/bus/pci/devices/0000\:00\:00.0/sriovnumvfs pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001 fslenetcvf 0000:00:01.0: Adding to iommu group 15 fslenetcvf 0000:00:01.0: enabling device (0000 -> 0002) fslenetcvf 0000:00:01.0 eno0vf0: renamed from eth0 $ tc qdisc replace dev eno0vf0 root taprio numtc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ sched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2 Unable to handle kernel paging request at virtual address ffff800009551a08 Internal error: Oops: 96000007 [#1] PREEMPT SMP pc : enetcsetuptctaprio+0x170/0x47c lr : enetcsetuptctaprio+0x16c/0x47c Call trace: enetcsetuptctaprio+0x170/0x47c enetcsetuptc+0x38/0x2dc tapriochange+0x43c/0x970 taprioinit+0x188/0x1e0 qdisccreate+0x114/0x470 tcmodifyqdisc+0x1fc/0x6c0 rtnetlinkrcvmsg+0x12c/0x390
Split enetcsetuptc() into separate functions for the PF and for the VF drivers. Also remove enetc_qos.o from being included into enetc-vf.ko, since it serves absolutely no purpose there.
{ "vanir_signatures": [ { "deprecated": false, "id": "CVE-2022-48645-12d47393", "signature_version": "v1", "digest": { "line_hashes": [ "143596509745049640223437909971926840157", "154309152994583319004535909830563904894", "136995784672358231678482266595651963565", "88963229242149002886007228261792281103", "11396202153160736008474533724284814671", "7120310617195391503983731247284995706", "156156185473652116636857099341055635097" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc_vf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@510e703e4ed0e011db860bc21228aff48fc9eea7" }, { "deprecated": false, "id": "CVE-2022-48645-18d0ce94", "signature_version": "v1", "digest": { "line_hashes": [ "143596509745049640223437909971926840157", "154309152994583319004535909830563904894", "136995784672358231678482266595651963565", "88963229242149002886007228261792281103", "11396202153160736008474533724284814671", "7120310617195391503983731247284995706", "156156185473652116636857099341055635097" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc_vf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42" }, { "deprecated": false, "id": "CVE-2022-48645-192e6201", "signature_version": "v1", "digest": { "line_hashes": [ "143596509745049640223437909971926840157", "154309152994583319004535909830563904894", "136995784672358231678482266595651963565", "88963229242149002886007228261792281103", "11396202153160736008474533724284814671", "7120310617195391503983731247284995706", "156156185473652116636857099341055635097" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc_vf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23022b74b1a23bed044f6bc96cf92f6ca5f3e75f" }, { "deprecated": false, "id": "CVE-2022-48645-34112480", "signature_version": "v1", "digest": { "line_hashes": [ "203363025814256147095355806050101846522", "312877353667528032810480424554153528179", "230180843144780575015583219896929400158", "132718381359232483896258667225067458467", "182084332289516738832122726958769289409", "196101591120823958800403279649380744398", "186163038713891367334942829013626470187", "64866241604600867997367926836784097193", "176409738577675550455988649070192596298", "99727241878837625080720000032423726299", "269685019892428373634990981106460911985", "180728420720923016717360306702708745012", "67848663625779039274102538875383396510", "268698961825895258339281376488881638642", "287205471618535722047225804241167901313", "53103781767531131900925478085195956875", "261650773636263419473490945857016257852", "181079502911311734696343008865835497064", "127648639372485687972324659809373241600", "297221913961024398487234246977299545778", "189682732521014268971803412441859561204", "167951959162067929559215845117112557362", "148970279090343982251597116873450395117", "335141022003742851096945098781162962322", "327362423622595816743150008107860735319" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@510e703e4ed0e011db860bc21228aff48fc9eea7" }, { "deprecated": false, "id": "CVE-2022-48645-3a3ce452", "signature_version": "v1", "digest": { "length": 843.0, "function_hash": "337590884125913755879529465175660415007" }, "signature_type": "Function", "target": { "function": "enetc_setup_tc_mqprio", "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@510e703e4ed0e011db860bc21228aff48fc9eea7" }, { "deprecated": false, "id": "CVE-2022-48645-42d15bb8", "signature_version": "v1", "digest": { "line_hashes": [ "143596509745049640223437909971926840157", "154309152994583319004535909830563904894", "136995784672358231678482266595651963565", "305487139695441483279327258002888537461", "95709928148437065040186089377222175323", "153801286193657431057326808766854402135", "10925312340823310446481071764905869835" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc_pf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23022b74b1a23bed044f6bc96cf92f6ca5f3e75f" }, { "deprecated": false, "id": "CVE-2022-48645-515d04c3", "signature_version": "v1", "digest": { "line_hashes": [ "203363025814256147095355806050101846522", "312877353667528032810480424554153528179", "230180843144780575015583219896929400158", "132718381359232483896258667225067458467", "182084332289516738832122726958769289409", "196101591120823958800403279649380744398", "186163038713891367334942829013626470187", "64866241604600867997367926836784097193", "176409738577675550455988649070192596298", "99727241878837625080720000032423726299", "269685019892428373634990981106460911985", "180728420720923016717360306702708745012", "67848663625779039274102538875383396510", "268698961825895258339281376488881638642", "287205471618535722047225804241167901313", "53103781767531131900925478085195956875", "261650773636263419473490945857016257852", "181079502911311734696343008865835497064", "127648639372485687972324659809373241600", "297221913961024398487234246977299545778", "189682732521014268971803412441859561204", "167951959162067929559215845117112557362", "148970279090343982251597116873450395117", "335141022003742851096945098781162962322", "327362423622595816743150008107860735319" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42" }, { "deprecated": false, "id": "CVE-2022-48645-5524edf0", "signature_version": "v1", "digest": { "line_hashes": [ "143596509745049640223437909971926840157", "154309152994583319004535909830563904894", "136995784672358231678482266595651963565", "305487139695441483279327258002888537461", "95709928148437065040186089377222175323", "153801286193657431057326808766854402135", "10925312340823310446481071764905869835" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc_pf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@510e703e4ed0e011db860bc21228aff48fc9eea7" }, { "deprecated": false, "id": "CVE-2022-48645-60d7db90", "signature_version": "v1", "digest": { "line_hashes": [ "231287800427071002782861657478168319852", "225892580094187078888704493453555878248", "131759500128841103837280516677133138053", "305854094385164574935533830008491286654", "190824424805403824186988559592422127730" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc.h" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23022b74b1a23bed044f6bc96cf92f6ca5f3e75f" }, { "deprecated": false, "id": "CVE-2022-48645-a03d7386", "signature_version": "v1", "digest": { "line_hashes": [ "231287800427071002782861657478168319852", "225892580094187078888704493453555878248", "131759500128841103837280516677133138053", "305854094385164574935533830008491286654", "190824424805403824186988559592422127730" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc.h" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42" }, { "deprecated": false, "id": "CVE-2022-48645-b0815d64", "signature_version": "v1", "digest": { "line_hashes": [ "231287800427071002782861657478168319852", "225892580094187078888704493453555878248", "131759500128841103837280516677133138053", "305854094385164574935533830008491286654", "190824424805403824186988559592422127730" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc.h" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@510e703e4ed0e011db860bc21228aff48fc9eea7" }, { "deprecated": false, "id": "CVE-2022-48645-c360c40a", "signature_version": "v1", "digest": { "line_hashes": [ "203363025814256147095355806050101846522", "312877353667528032810480424554153528179", "230180843144780575015583219896929400158", "132718381359232483896258667225067458467", "182084332289516738832122726958769289409", "196101591120823958800403279649380744398", "186163038713891367334942829013626470187", "64866241604600867997367926836784097193", "176409738577675550455988649070192596298", "99727241878837625080720000032423726299", "269685019892428373634990981106460911985", "180728420720923016717360306702708745012", "67848663625779039274102538875383396510", "268698961825895258339281376488881638642", "287205471618535722047225804241167901313", "53103781767531131900925478085195956875", "261650773636263419473490945857016257852", "181079502911311734696343008865835497064", "127648639372485687972324659809373241600", "297221913961024398487234246977299545778", "189682732521014268971803412441859561204", "167951959162067929559215845117112557362", "148970279090343982251597116873450395117", "335141022003742851096945098781162962322", "327362423622595816743150008107860735319" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23022b74b1a23bed044f6bc96cf92f6ca5f3e75f" }, { "deprecated": false, "id": "CVE-2022-48645-c5cc9d34", "signature_version": "v1", "digest": { "length": 431.0, "function_hash": "201389979140212183039885078471929131323" }, "signature_type": "Function", "target": { "function": "enetc_setup_tc", "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@510e703e4ed0e011db860bc21228aff48fc9eea7" }, { "deprecated": false, "id": "CVE-2022-48645-cee3897e", "signature_version": "v1", "digest": { "length": 431.0, "function_hash": "201389979140212183039885078471929131323" }, "signature_type": "Function", "target": { "function": "enetc_setup_tc", "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23022b74b1a23bed044f6bc96cf92f6ca5f3e75f" }, { "deprecated": false, "id": "CVE-2022-48645-d30ab381", "signature_version": "v1", "digest": { "length": 843.0, "function_hash": "337590884125913755879529465175660415007" }, "signature_type": "Function", "target": { "function": "enetc_setup_tc_mqprio", "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23022b74b1a23bed044f6bc96cf92f6ca5f3e75f" }, { "deprecated": false, "id": "CVE-2022-48645-ec3da391", "signature_version": "v1", "digest": { "line_hashes": [ "143596509745049640223437909971926840157", "154309152994583319004535909830563904894", "136995784672358231678482266595651963565", "305487139695441483279327258002888537461", "95709928148437065040186089377222175323", "153801286193657431057326808766854402135", "10925312340823310446481071764905869835" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/ethernet/freescale/enetc/enetc_pf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42" }, { "deprecated": false, "id": "CVE-2022-48645-f1f756d2", "signature_version": "v1", "digest": { "length": 431.0, "function_hash": "201389979140212183039885078471929131323" }, "signature_type": "Function", "target": { "function": "enetc_setup_tc", "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42" }, { "deprecated": false, "id": "CVE-2022-48645-f95e46c2", "signature_version": "v1", "digest": { "length": 843.0, "function_hash": "337590884125913755879529465175660415007" }, "signature_type": "Function", "target": { "function": "enetc_setup_tc_mqprio", "file": "drivers/net/ethernet/freescale/enetc/enetc.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42" } ] }