In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netdevsim: update queue NAPI association on queue reset<\/p>\n
In netdevsim, receive queues (struct nsim_rq) embed their own struct
\nnapi_struct. When queue reset is performed (e.g. via queue_reset
\ndebugfs), nsim_queue_start() swaps in a newly allocated struct nsim_rq,
\nand nsim_queue_mem_free() later deletes and frees the old one.<\/p>\n
However, nsim_queue_start() failed to update the queue-to-NAPI mapping
\nvia netif_queue_set_napi(). As a result, dev->_rx[idx].napi continued to
\npoint to the old NAPI struct. After the old queue was freed, a subsequent
\nqueue dump via Netlink (NETDEV_CMD_QUEUE_GET) triggered a KASAN
\nslab-use-after-free read in nla_put_napi_id() when accessing
\nrxq->napi->napi_id.<\/p>\n
Fix this by calling netif_queue_set_napi() in nsim_queue_start() to
\nassociate the new NAPI with the RX queue, and clear the association
\nwith netif_queue_set_napi(…, NULL) in nsim_del_napi() during teardown.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netdevsim: update queue NAPI association on queue reset<\/p>\n
In netdevsim, receive queues (struct nsim_rq) embed their own struct
\nnapi_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25522","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}