In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
qede: Fix NULL pointer dereference in TPA fragment processing<\/p>\n
Under memory pressure, the qede driver encounters NULL pointer
\ndereferences when processing TPA continuation fragments.<\/p>\n
Commit 8a8633978b84 (“qede: Add build_skb() support.”) accidentally
\ndropped the assignment of tpa_info->buffer.data in qede_tpa_start().<\/p>\n
When memory pressure causes an SKB allocation failure in qede_tpa_start(),
\nthe driver sets tpa_start_fail = true and attempts to recycle the physical
\npage later in qede_tpa_end() via qede_reuse_page(). However, because
\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a
\n“ghost” BD (valid DMA mapping but NULL data pointer) back into the
\nactive Rx ring.<\/p>\n
The next time the hardware uses this ring slot, it passes a NULL page
\nto qede_fill_frag_skb(), causing a kernel panic.<\/p>\n
Example crash from production system:
\n BUG: unable to handle kernel NULL pointer dereference at 0x8
\n RIP: qede_fill_frag_skb+0x96\/0x430 [qede]
\n Call Trace:
\n qede_rx_int+0xb06\/0x1de0
\n qede_poll+0x2f4\/0x6c0
\n __napi_poll+0x2d\/0x130<\/p>\n
Fix the root cause by restoring the tpa_info->buffer.data assignment
\nin qede_tpa_start(), ensuring valid pages are correctly tracked and
\nrecycled. Additionally, update the stale comment for
\nstruct qede_agg_info::buffer to reflect its current usage.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
qede: Fix NULL pointer dereference in TPA fragment processing<\/p>\n
Under memory pressure, the qede driver encounters NULL pointer
\nderef<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21433","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}