In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bnxt: fix head underflow on XDP head-grow<\/p>\n
The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on
\na bnxt machine (and also crashes in NIPA).<\/p>\n
It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which
\nbuilds the skb head:<\/p>\n
napi_build_skb(data_ptr – bp->rx_offset, rxr->rx_page_size);<\/p>\n
The problem with this expression is that in page mode, rx_offset is:<\/p>\n
bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;<\/p>\n
Which evaluates (at least on x86_64) to 258.<\/p>\n
The test test_xdp_native_adjst_head_grow_data tests a case where the
\nhead is adjusted by -256.<\/p>\n
When this test runs, data_ptr is shifted to frag_start + 2 (where
\nfrag_start = page_address(page) + offset).<\/p>\n
Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb
\nexpression subtracts 258, landing at an address before frag_start. This
\ncould be either the previous fragment or the previous physical page when
\nthe offset is = 64k, but it unintentionally broke the head grow
\ncase.<\/p>\n
To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the
\nexisting offset field in struct bnxt_sw_rx_agg_bd. Populate it on
\nallocation and preserve it on reuse.<\/p>\n
In bnxt_rx_multi_page_skb, use the newly added offset field to compute
\nthe fragment start and pass that to napi_build_skb. Adjust the layout
\nwith skb_reserve.<\/p>\n
There are two cases, the non-adjustment case and the adjustment case.<\/p>\n
In both cases, the skb is built at page_address(page) + offset to
\naccount for the case where the native page size >= 64K and skb_reserve
\nis called with data_ptr – (page_address(page) + offset). That
\ndifference equals bp->rx_offset when data_ptr was not moved, or
\nbp->rx_offset + xdp_adjust when XDP adjusted the head.<\/p>\n
Re-running the failing test with this commit applied causes the test to
\nrun successfully to completion.<\/p>\n
The other rx_skb_func implementations don’t have this issue.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bnxt: fix head underflow on XDP head-grow<\/p>\n
The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on
\na bnxt machine <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7204","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}