In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
idpf: disable DIM work before freeing q_vectors<\/p>\n
idpf never drains the Tx\/Rx DIM works before freeing the memory they
\nlive in. tx_dim and rx_dim are embedded in struct idpf_q_vector, they
\nare queued from the NAPI poll via net_dim(), and idpf_vport_intr_rel()
\nends with kfree(rsrc->q_vectors). Nothing in the driver cancels them.<\/p>\n
idpf_tx_dim_work() and idpf_rx_dim_work() then run on freed memory:
\nidpf_vport_intr_write_itr() writes the ITR register through
\nq_vector->intr_reg.tx_itr \/ rx_itr, void __iomem pointers loaded out of
\nthe freed q_vector. No configuration is needed to get there —
\nIDPF_ITR_IS_DYNAMIC() is defined as (itr_mode) and idpf_vport_alloc()
\ninitialises both modes to IDPF_ITR_DYNAMIC.<\/p>\n
Draining after idpf_vport_intr_napi_dis_all() is not enough on its own.
\nidpf_net_dim() is called from inside the
\n“if (napi_complete_done(napi, work_done))” branch of the poll, and
\nnapi_complete_done() has already cleared NAPIF_STATE_SCHED by then.
\nnapi_disable_locked() waits only while (val & (NAPIF_STATE_SCHED |
\nNAPIF_STATE_NPSVC)), so napi_disable() can return while the poll tail is
\nstill queueing the work, and a plain cancel_work_sync() would be
\nre-armed behind the drain.<\/p>\n
Use disable_work_sync(): schedule_work() on a work with a non-zero
\ndisable count is dropped by clear_pending_if_disabled() before
\n__queue_work() is reached.<\/p>\n
Move idpf_init_dim() to idpf_vport_intr_alloc() so the works are
\ninitialised on every path that can reach the drain — the three
\n“goto intr_deinit” sites between idpf_vport_intr_init() and
\nidpf_vport_intr_ena() get there without the enable side having run.
\nNothing re-enables them: rsrc->q_vectors is freed on every exit from
\nidpf_vport_open() and on every idpf_vport_stop(), so the count dies with
\nthe object.<\/p>\n
It is a race, not a deterministic failure — net_dim() only schedules
\nonce DIM_NEVENTS events have accumulated and the profile index changes.
\nA KASAN ifup\/ifdown loop under load is the way to see it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
idpf: disable DIM work before freeing q_vectors<\/p>\n
idpf never drains the Tx\/Rx DIM works before freeing the memory they
\nlive in. tx_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29035","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}