ionic: fix use after netif_napi_del()
In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, only 3 queues' napi should be registered and enabled. The ionic_qcq_enable() checks whether the .poll pointer is not NULL for enabling only the using queue' napi. Unused queues' napi will not be registered by netif_napi_add(), so the .poll pointer indicates NULL. But it couldn't distinguish whether the napi was unregistered or not because netif_napi_del() doesn't reset the .poll pointer to NULL. So, ionic_qcq_enable() calls napi_enable() for the queue, which was unregistered by netif_napi_del(). Reproducer: ethtool -L rx 1 tx 1 combined 0 ethtool -L rx 0 tx 0 combined 1 ethtool -L rx 0 tx 0 combined 4 Splat looks like: kernel BUG at net/core/dev.c:6666! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16 Workqueue: events ionic_lif_deferred_work [ionic] RIP: 0010:napi_enable+0x3b/0x40 Code: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f RSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28 RBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001
CVE-2024-39502
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-39502
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
"lessThan": "0d19267cb150e8f76ade210e16ee820a77f684e7",
"versionType": "git"
},
{
"status": "affected",
"version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
"lessThan": "ff9c2a9426ecf5b9631e9fd74993b357262387d6",
"versionType": "git"
},
{
"status": "affected",
"version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
"lessThan": "8edd18dab443863e9e48f084e7f123fca3065e4e",
"versionType": "git"
},
{
"status": "affected",
"version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
"lessThan": "60cd714871cd5a683353a355cbb17a685245cf84",
"versionType": "git"
},
{
"status": "affected",
"version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
"lessThan": "183ebc167a8a19e916b885d4bb61a3491991bfa5",
"versionType": "git"
},
{
"status": "affected",
"version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
"lessThan": "a87d72b37b9ec2c1e18fe36b09241d8b30334a2e",
"versionType": "git"
},
{
"status": "affected",
"version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
"lessThan": "79f18a41dd056115d685f3b0a419c7cd40055e13",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/pensando/ionic/ionic_lif.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.279",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.221",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.162",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.95",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.35",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.9.6",
"versionType": "semver",
"lessThanOrEqual": "6.9.*"
},
{
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/pensando/ionic/ionic_lif.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-39502
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26633 · Revision 1
- Added to Heist Feed
- Publisher date