In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xsk: fix NULL pointer dereference in __xsk_rcv()<\/p>\n
In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a
\nloop without checking its return value. xsk_buff_can_alloc() only
\ncounts fill queue entries without validating their addresses, so it
\ncan succeed while xsk_buff_alloc() rejects all remaining entries and
\nreturns NULL.<\/p>\n
Oops: general protection fault, probably for non-canonical address
\n 0xdffffc0000000000
\n KASAN: null-ptr-deref in range
\n [0x0000000000000000-0x0000000000000007]
\n RIP: 0010:__xsk_rcv+0x426\/0xc20 (net\/xdp\/xsk.c:350)
\n Call Trace:
\n xsk_generic_rcv+0x26d\/0x5f0
\n xdp_do_generic_redirect+0x3c5\/0xcf0
\n do_xdp_generic+0x92f\/0xe70
\n __netif_receive_skb_core.constprop.0+0xf7e\/0x2b30<\/p>\n
Fix this with a two-stage transaction. First allocate and stage all
\nbuffers required for the packet, recycling all staged buffers with
\nxsk_buff_free() if any allocation fails. Only after this stage
\nsucceeds, copy the data, reserve the RX descriptors, and release the
\nbuffers in an error-free loop.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xsk: fix NULL pointer dereference in __xsk_rcv()<\/p>\n
In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a
\nloop withou<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25524","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}