In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: ethernet: mtk_eth_soc: allocate dummy netdev sooner<\/p>\n
The RX rings and the shared NAPI are carried by an internal “dummy” netdev
\n(eth->dummy_dev). mtk_probe() creates that dummy device, and adds the
\nshared tx\/rx NAPI to it, only after the MAC netdevs have been registered.
\nThat order has been there since the MT7623 support was added and leaves a
\nwindow in which the netdevs are visible to the network core before the
\nshared NAPI and the dummy device exist.<\/p>\n
If anything brings the first netdev up during that window (e.g. netifd
\nopening the WAN link the instant the interface is registered), the
\nfirst-open path runs without them. On NETSYS v2 and later SoCs
\nmtk_rx_alloc() -> __xdp_rxq_info_reg() then dereferences eth->dummy_dev ==
\nNULL:<\/p>\n
WARNING: CPU: … Missing net_device from driver<\/p>\n
in net\/core\/xdp.c and mtk_open() fails with -ENODEV. On NETSYS v1 SoCs
\n(MT7621\/MT7622\/MT7623\/MT7629) there is no page pool, so the same open
\ninstead calls napi_enable() on a napi_struct that netif_napi_add() has not
\ninitialised yet and dereferences a NULL napi->dev.<\/p>\n
Allocate the dummy netdev and add the shared tx\/rx NAPI to it before the
\nregister_netdev() loop. Both the dummy-allocation failure and a
\nregister_netdev() failure now unwind through mtk_unreg_dev(), which
\nunregisters the net_device notifiers and the netdevs registered so far,
\nstopping a concurrently-opened netdev (ndo_stop) and its NAPI before the
\ndummy carrier is freed.<\/p>\n
A netdev that opened during the window can also have queued the
\nframe-engine reset worker (via the tx watchdog or phylink), so the probe
\nerror path now cancels eth->pending_work before freeing the shared state,
\nas mtk_cleanup() already does on remove.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: ethernet: mtk_eth_soc: allocate dummy netdev sooner<\/p>\n
The RX rings and the shared NAPI are carried by an internal “dummy” netde<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41268","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}