In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: ifb: report ethtool stats over num_tx_queues<\/p>\n
ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues
\nentries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB
\nper-queue RX and TX stats live in those entries: ifb_xmit() updates
\ntxp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates
\ntxp->tx_stats, and ifb_stats64() aggregates both over
\ndev->num_tx_queues.<\/p>\n
The ethtool stats callbacks instead size and walk the per-queue
\nstats with dev->real_num_rx_queues and dev->real_num_tx_queues. With
\nan asymmetric device where the RX queue count exceeds the TX queue
\ncount, for example:<\/p>\n
ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb
\n ethtool -S ifb10<\/p>\n
ifb_get_ethtool_stats() indexes past the tx_private allocation and
\ncopies adjacent slab data through ETHTOOL_GSTATS.<\/p>\n
Use dev->num_tx_queues consistently for the stats strings, the
\nstats count, and the stats data walks. This reports one RX stats
\ngroup and one TX stats group for each backing ifb_q_private entry,
\nwhich is the queue set IFB can actually populate.<\/p>\n
Reproduced under UML+KASAN at v7.1-rc2:<\/p>\n
BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c\/0xae
\n Read of size 8 at addr 0000000062dbd228 by task ethtool\/36
\n ifb_fill_stats_data+0x3c\/0xae
\n ifb_get_ethtool_stats+0xc0\/0x129
\n __dev_ethtool+0x1ca5\/0x363c
\n dev_ethtool+0x123\/0x1b3
\n dev_ioctl+0x56c\/0x744
\n sock_do_ioctl+0x15f\/0x1b2
\n sock_ioctl+0x4d5\/0x50a
\n sys_ioctl+0xd8b\/0xde9<\/p>\n
With the patch applied, the same UML+KASAN repro is silent and
\nethtool -S ifb10 reports only the stats backed by the single
\nallocated tx_private entry.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: ifb: report ethtool stats over num_tx_queues<\/p>\n
ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues
\nentries via kzallo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15088","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}