Kernel crash due to Bluefield pka TRNG ioctl call

[Shih-Yi Chen]

SRU Justification

[Impact]
Bluefield 3 on Ubuntu 22.04 and OpenSSL 3.0.2, encounters kernel crash/oops when HTTPS client uses OpenSSL with PKA engine during TLS handshake. The issue is with TRNG ioctl call. The kernel logs show the following errors.

Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000ffffce65d328

BF3 on Ubuntu 22.04, OpenSSl 3.0.2

[Fix]
* Change RNG ioctl kernel handler code to copy data from user to kernel space.

[Test Case]
openssl rand -engine pka 512

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-bluefield/5.4.0-1057.63 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-bluefield - 5.4.0-1058.64

---------------
linux-bluefield (5.4.0-1058.64) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1058.64 -proposed tracker (LP: #2006592)

  * nft_lookup crash when running DDOS attack (LP: #2006397)
    - netfilter: nf_tables: constify nft_reg_load{8, 16, 64}()
    - netfilter: nft_set_bitmap: initialize set element extension in lookups
    - netfilter: nf_tables: do not update stateful expressions if lookup is
      inverted

linux-bluefield (5.4.0-1057.63) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1057.63 -proposed tracker (LP: #2003464)

  * Focal update: v5.4.221 upstream stable release (LP: #1997993)
    - [Config] bluefield: Enable ARM64_ERRATUM_1742098 config on arm64

  * mlxbf-pmc counters not functional for llt_miss block (LP: #2004235)
    - SAUCE: mlxbf-pmc: Bug fix for BlueField-3 counter offsets

  * Add support for CT accounting stats (LP: #1998938)
    - netfilter: conntrack: export nf_ct_acct_update()
    - netfilter: flowtable: add counter support
    - net/sched: act_ct: update nf_conn_acct for act_ct SW offload in flowtable
    - net/sched: act_ct: enable stats for HW offloaded entries

  * allow per-net notifier to follow netdev into namespace (LP: #2002361)
    - net: push loops and nb calls into helper functions
    - net: introduce per-netns netdevice notifiers
    - net: push code from net notifier reg/unreg into helpers
    - net: introduce dev_net notifier register/unregister variants

  * mlxbf-pmc support for BlueField-3 (LP: #2002501)
    - SAUCE: mlxbf-pmc: Support for BlueField-3 performance counters

  * Kernel crash due to Bluefield pka TRNG ioctl call (LP: #2001564)
    - SAUCE: mlxbf-pka: Fix kernel crash with pka TRNG ioctl call

  * mlxbf-pmc: Fix event string typo (LP: #1998863)
    - SAUCE: mlxbf-pmc: Fix event string typo

  [ Ubuntu: 5.4.0-139.156 ]

  * focal/linux: 5.4.0-139.156 -proposed tracker (LP: #2003486)
  * Revoke & rotate to new signing key (LP: #2002812)
    - [Packaging] Revoke and rotate to new signing key

  [ Ubuntu: 5.4.0-138.155 ]

  * focal/linux: 5.4.0-138.155 -proposed tracker (LP: #2001845)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
  * Focal update: v5.4.224 upstream stable release (LP: #1999273)
    - RDMA/cma: Use output interface for net_dev check
    - IB/hfi1: Correctly move list in sc_disable()
    - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
    - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
    - nfs4: Fix kmemleak when allocate slot failed
    - net: dsa: Fix possible memory leaks in dsa_loop_init()
    - RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
    - RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
    - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
    - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
    - net: fec: fix improper use of NETDEV_TX_BUSY
    - ata: pata_legacy: fix pdc20230_set_piomode()
    - net: sched: Fix use after free in red_enqueue()
    - net: tun: fix bugs for oversize packet when napi frags enabled
    - netfilter: nf_tables: release flow ru...