In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
eth: fbnic: reset num_napi when the napi vectors are freed<\/p>\n
fbn->num_napi is the count of live napi vectors, each of which owns an
\nIRQ. The PM path had freed them without clearing the count.
\nfbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the
\nIRQs, but leaves netif_running() true so resume knows to re-open. Resume
\nrebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets
\nnum_napi and __fbnic_open() re-allocates the vectors.<\/p>\n
When the datapath is torn down but never rebuilt, num_napi is left
\npointing at freed vectors under 2 different scenarios:
\n – a PCIe error recovery that fails (fbnic_err_slot_reset() ->
\n __fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so
\n .resume never runs; or
\n – an __fbnic_open() that fails partway on resume and unwinds, freeing
\n the vectors after fbnic_reset_queues() has already set num_napi.<\/p>\n
The netdev is then running with num_napi > 0 but napi[] freed, and the
\neventual remove\/unbind close re-enters fbnic_down() -> fbnic_dbg_down()
\nand dereferences the freed vectors:
\n BUG: kernel NULL pointer dereference, address: 0000000000000210
\n RIP: fbnic_dbg_down+0x28<\/p>\n
Clear num_napi when the vectors are freed: in the suspend teardown (a
\ngood resume re-establishes it before __fbnic_open()) and on the resume
\nopen failure. A redundant ndo_stop() then walks an empty napi[]. The
\nnormal ndo_stop() down\/up cycle is untouched and keeps num_napi for the
\nnext ndo_open().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
eth: fbnic: reset num_napi when the napi vectors are freed<\/p>\n
fbn->num_napi is the count of live napi vectors, each of which owns an<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41088","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}