In the Linux kernel, the following vulnerability has been resolved:
net: sfc: add missing xdp queue reinitialization
After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDPTX or XDPREDIRECT.
When tx/rx ring buffer size is changed(ethtool -G), sfc driver reallocates and reinitializes rx and tx queues and their buffer (txqueue->buffer). But it misses reinitializing xdp queues(efx->xdptxqueues). So, while it is acting XDPTX or XDPREDIRECT, it uses the uninitialized txqueue->buffer.
A new function efxsetxdpchannels() is separated from efxset_channels() to handle only xdp queues.
Splat looks like: BUG: kernel NULL pointer dereference, address: 000000000000002a #PF: supervisor write access in kernel mode #PF: errorcode(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#4] PREEMPT SMP NOPTI RIP: 0010:efxtxmapchunk+0x54/0x90 [sfc] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D 5.17.0+ #55 e8beeee8289528f11357029357cf Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297 RIP: 0010:efxtxmapchunk+0x54/0x90 [sfc] RAX: 0000000000000040 RBX: ffff92ea506895c0 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001139b10ce RDI: ffff92ea506895c0 RBP: ffffffffc0358a80 R08: 00000001139b110d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001139b10ce R15: ffff92ea506895c0 FS: 0000000000000000(0000) GS:ffff92f121ec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 CR2: 000000000000002a CR3: 00000003e6810004 CR4: 00000000007706e0 RSP: 0018:ffff92f121e85c60 EFLAGS: 00010297 PKRU: 55555554 RAX: 0000000000000040 RBX: ffff92ea50689700 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001145a90ce RDI: ffff92ea50689700 RBP: ffffffffc0358a80 R08: 00000001145a910d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001145a90ce R15: ffff92ea50689700 FS: 0000000000000000(0000) GS:ffff92f121e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002a CR3: 00000003e6810005 CR4: 00000000007706e0 PKRU: 55555554 Call Trace: <IRQ> efxxdptxbuffers+0x12b/0x3d0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] _efxrxpacket+0x5c3/0x930 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efxrxpacket+0x28c/0x2e0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efxef10evprocess+0x5f8/0xf40 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] ? enqueuetaskfair+0x95/0x550 efx_poll+0xc4/0x360 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5]
[
{
"id": "CVE-2022-49096-07e84f5e",
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "294420847401716680371765845589882598302"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_set_xdp_tx_queue"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc85e1593686e42c6749ef3d356db34759d59e8",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-0fbb12c2",
"signature_type": "Function",
"digest": {
"length": 2090.0,
"function_hash": "123990933910201860215863513944750245823"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_realloc_channels"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7a824fda8732578d1014fad1f7fb0363705090",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-12174433",
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "294420847401716680371765845589882598302"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_set_xdp_tx_queue"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8c46bc358d84701e7f7ffa054037db25f25da0e",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-1d348e37",
"signature_type": "Function",
"digest": {
"length": 2010.0,
"function_hash": "425764762611842702399717516804274634"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_realloc_channels"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059a47f1da93811d37533556d67e72f2261b1127",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-2d2707e4",
"signature_type": "Function",
"digest": {
"length": 1766.0,
"function_hash": "200554917988213636075326213820697093040"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_set_channels"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059a47f1da93811d37533556d67e72f2261b1127",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-40d7229b",
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "294420847401716680371765845589882598302"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_set_xdp_tx_queue"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7a824fda8732578d1014fad1f7fb0363705090",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-58560e8b",
"signature_type": "Function",
"digest": {
"length": 1766.0,
"function_hash": "200554917988213636075326213820697093040"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_set_channels"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc85e1593686e42c6749ef3d356db34759d59e8",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-6f8ba105",
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "294420847401716680371765845589882598302"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_set_xdp_tx_queue"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059a47f1da93811d37533556d67e72f2261b1127",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-8dc3cf52",
"signature_type": "Function",
"digest": {
"length": 2010.0,
"function_hash": "425764762611842702399717516804274634"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_realloc_channels"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc85e1593686e42c6749ef3d356db34759d59e8",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-9517d2e7",
"signature_type": "Function",
"digest": {
"length": 1766.0,
"function_hash": "200554917988213636075326213820697093040"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_set_channels"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8c46bc358d84701e7f7ffa054037db25f25da0e",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-9d56cf37",
"signature_type": "Function",
"digest": {
"length": 2090.0,
"function_hash": "123990933910201860215863513944750245823"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_realloc_channels"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8c46bc358d84701e7f7ffa054037db25f25da0e",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-9fed2d68",
"signature_type": "Line",
"digest": {
"line_hashes": [
"314456574570319593615914515917961386505",
"318282386433591174019200173817323181400",
"130728210181493507027015461958238203479",
"280950587304234922259839524221791483959",
"310821467293002033740676730151188959148",
"112812141080351992534497989177321782361",
"210274722111188715331718929643241348053",
"199046487086778756126482733303355775535",
"251361381997223867684530108886323175307",
"260832987654518994228421990531701758135",
"272903385020709666692056562730452017965",
"89014616945471759686033325811006747619",
"178452915517746289902911093895836732115",
"52509756766964357127915047019019521190",
"126975896322264436996245743805364022848",
"44287848373346077112603953331819510680",
"197697270556182762544271351702678253511",
"74831815742778634445740974018208254875",
"280748308240013033905410684241712361010",
"79516361563074297262445395735305766528",
"42481612471190476629745028525522140156",
"61309894743467017293427455878015945607",
"30600765917714702766498611522020189955",
"154144629066437654919719269089181855944",
"178710273345924690865013355924822323477",
"217577207695821045744669227484385847816",
"150242443131833083510737984887447875333",
"212358768674074814632403362695451718056",
"3616480090664483972580439972141009189",
"226353490112122657577838201588599752471",
"276198033888644418908939971515539021768",
"53773542899053505705672511422875595903",
"2033921690943061536890140750761465985",
"281369403363874719969158997364921728080",
"7125343498576563920095020183650555069",
"19374703588385360742773903578240928796",
"108882020833305702975594007600309719547",
"263358787105420934341717383225083331421",
"158573873128147146870291931760704950748",
"328621830457408971576313530067804942142",
"136476315436942806948909760712332993137",
"186608332586281970704660856012352119223",
"158460023427168366037576519995551461161",
"306074076703391382033831932573051189088",
"110551635624430856746430526677552243559",
"44609881163532797781931900298759426789",
"43343410791702664993688026274896009318",
"44074261543489698428607497755020739959",
"258692084990588860938688757391270864216",
"75925458710813482488318802113978345174",
"248398106062698723225245398376508743374",
"203419201400327120383377846954525225775",
"200434949374322438810673788499023870031",
"136476315436942806948909760712332993137",
"154919783267435660921595288495506448558",
"67099195536254163879183904522831098223",
"108587633537507210242609878158511307392",
"139695317622413377597846905583937072789",
"298108832666481022864401995374860710408",
"120501377113856357396973326699270228676",
"209106322319566559456555421370640046747",
"117022300649574002542915108907014906378",
"163698965423282611531919811537906056101",
"38375934212153253393265539830941823763",
"75160837033459526394215868554201466184",
"67496912045325639484479633585837097669",
"23148943778385649736188185037366047342",
"136476315436942806948909760712332993137",
"11236932833056520568236915465075281763",
"17839436954179760654658111376708122567",
"96203084739348519890404059298732581589"
],
"threshold": 0.9
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc85e1593686e42c6749ef3d356db34759d59e8",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-b5b19b7b",
"signature_type": "Line",
"digest": {
"line_hashes": [
"314456574570319593615914515917961386505",
"318282386433591174019200173817323181400",
"130728210181493507027015461958238203479",
"280950587304234922259839524221791483959",
"310821467293002033740676730151188959148",
"112812141080351992534497989177321782361",
"49621976000807743501698389766360848395",
"199046487086778756126482733303355775535",
"251361381997223867684530108886323175307",
"260832987654518994228421990531701758135",
"272903385020709666692056562730452017965",
"89014616945471759686033325811006747619",
"178452915517746289902911093895836732115",
"52509756766964357127915047019019521190",
"126975896322264436996245743805364022848",
"44287848373346077112603953331819510680",
"197697270556182762544271351702678253511",
"74831815742778634445740974018208254875",
"280748308240013033905410684241712361010",
"79516361563074297262445395735305766528",
"42481612471190476629745028525522140156",
"61309894743467017293427455878015945607",
"30600765917714702766498611522020189955",
"154144629066437654919719269089181855944",
"178710273345924690865013355924822323477",
"217577207695821045744669227484385847816",
"150242443131833083510737984887447875333",
"212358768674074814632403362695451718056",
"3616480090664483972580439972141009189",
"226353490112122657577838201588599752471",
"276198033888644418908939971515539021768",
"53773542899053505705672511422875595903",
"2033921690943061536890140750761465985",
"281369403363874719969158997364921728080",
"7125343498576563920095020183650555069",
"19374703588385360742773903578240928796",
"108882020833305702975594007600309719547",
"263358787105420934341717383225083331421",
"158573873128147146870291931760704950748",
"328621830457408971576313530067804942142",
"136476315436942806948909760712332993137",
"186608332586281970704660856012352119223",
"158460023427168366037576519995551461161",
"306074076703391382033831932573051189088",
"110551635624430856746430526677552243559",
"44609881163532797781931900298759426789",
"43343410791702664993688026274896009318",
"44074261543489698428607497755020739959",
"258692084990588860938688757391270864216",
"75925458710813482488318802113978345174",
"248398106062698723225245398376508743374",
"203419201400327120383377846954525225775",
"200434949374322438810673788499023870031",
"136476315436942806948909760712332993137",
"154919783267435660921595288495506448558",
"67099195536254163879183904522831098223",
"108587633537507210242609878158511307392",
"139695317622413377597846905583937072789",
"298108832666481022864401995374860710408",
"120501377113856357396973326699270228676",
"209106322319566559456555421370640046747",
"117022300649574002542915108907014906378",
"163698965423282611531919811537906056101",
"38375934212153253393265539830941823763",
"75160837033459526394215868554201466184",
"67496912045325639484479633585837097669",
"23148943778385649736188185037366047342",
"136476315436942806948909760712332993137",
"11236932833056520568236915465075281763",
"17839436954179760654658111376708122567",
"96203084739348519890404059298732581589"
],
"threshold": 0.9
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7a824fda8732578d1014fad1f7fb0363705090",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-cd6d6876",
"signature_type": "Function",
"digest": {
"length": 1766.0,
"function_hash": "200554917988213636075326213820697093040"
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c",
"function": "efx_set_channels"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7a824fda8732578d1014fad1f7fb0363705090",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-e7868a25",
"signature_type": "Line",
"digest": {
"line_hashes": [
"314456574570319593615914515917961386505",
"318282386433591174019200173817323181400",
"130728210181493507027015461958238203479",
"280950587304234922259839524221791483959",
"310821467293002033740676730151188959148",
"112812141080351992534497989177321782361",
"49621976000807743501698389766360848395",
"199046487086778756126482733303355775535",
"251361381997223867684530108886323175307",
"260832987654518994228421990531701758135",
"272903385020709666692056562730452017965",
"89014616945471759686033325811006747619",
"178452915517746289902911093895836732115",
"52509756766964357127915047019019521190",
"126975896322264436996245743805364022848",
"44287848373346077112603953331819510680",
"197697270556182762544271351702678253511",
"74831815742778634445740974018208254875",
"280748308240013033905410684241712361010",
"79516361563074297262445395735305766528",
"42481612471190476629745028525522140156",
"61309894743467017293427455878015945607",
"30600765917714702766498611522020189955",
"154144629066437654919719269089181855944",
"178710273345924690865013355924822323477",
"217577207695821045744669227484385847816",
"150242443131833083510737984887447875333",
"212358768674074814632403362695451718056",
"3616480090664483972580439972141009189",
"226353490112122657577838201588599752471",
"276198033888644418908939971515539021768",
"53773542899053505705672511422875595903",
"2033921690943061536890140750761465985",
"281369403363874719969158997364921728080",
"7125343498576563920095020183650555069",
"19374703588385360742773903578240928796",
"108882020833305702975594007600309719547",
"263358787105420934341717383225083331421",
"158573873128147146870291931760704950748",
"328621830457408971576313530067804942142",
"136476315436942806948909760712332993137",
"186608332586281970704660856012352119223",
"158460023427168366037576519995551461161",
"306074076703391382033831932573051189088",
"110551635624430856746430526677552243559",
"44609881163532797781931900298759426789",
"43343410791702664993688026274896009318",
"44074261543489698428607497755020739959",
"258692084990588860938688757391270864216",
"75925458710813482488318802113978345174",
"248398106062698723225245398376508743374",
"203419201400327120383377846954525225775",
"200434949374322438810673788499023870031",
"136476315436942806948909760712332993137",
"154919783267435660921595288495506448558",
"67099195536254163879183904522831098223",
"108587633537507210242609878158511307392",
"139695317622413377597846905583937072789",
"298108832666481022864401995374860710408",
"120501377113856357396973326699270228676",
"209106322319566559456555421370640046747",
"117022300649574002542915108907014906378",
"163698965423282611531919811537906056101",
"38375934212153253393265539830941823763",
"75160837033459526394215868554201466184",
"67496912045325639484479633585837097669",
"23148943778385649736188185037366047342",
"136476315436942806948909760712332993137",
"11236932833056520568236915465075281763",
"17839436954179760654658111376708122567",
"96203084739348519890404059298732581589"
],
"threshold": 0.9
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8c46bc358d84701e7f7ffa054037db25f25da0e",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2022-49096-f9cea776",
"signature_type": "Line",
"digest": {
"line_hashes": [
"314456574570319593615914515917961386505",
"318282386433591174019200173817323181400",
"130728210181493507027015461958238203479",
"280950587304234922259839524221791483959",
"310821467293002033740676730151188959148",
"112812141080351992534497989177321782361",
"210274722111188715331718929643241348053",
"199046487086778756126482733303355775535",
"251361381997223867684530108886323175307",
"260832987654518994228421990531701758135",
"272903385020709666692056562730452017965",
"89014616945471759686033325811006747619",
"178452915517746289902911093895836732115",
"52509756766964357127915047019019521190",
"126975896322264436996245743805364022848",
"44287848373346077112603953331819510680",
"197697270556182762544271351702678253511",
"74831815742778634445740974018208254875",
"280748308240013033905410684241712361010",
"79516361563074297262445395735305766528",
"42481612471190476629745028525522140156",
"61309894743467017293427455878015945607",
"30600765917714702766498611522020189955",
"154144629066437654919719269089181855944",
"178710273345924690865013355924822323477",
"217577207695821045744669227484385847816",
"150242443131833083510737984887447875333",
"212358768674074814632403362695451718056",
"3616480090664483972580439972141009189",
"226353490112122657577838201588599752471",
"276198033888644418908939971515539021768",
"53773542899053505705672511422875595903",
"2033921690943061536890140750761465985",
"281369403363874719969158997364921728080",
"7125343498576563920095020183650555069",
"19374703588385360742773903578240928796",
"108882020833305702975594007600309719547",
"263358787105420934341717383225083331421",
"158573873128147146870291931760704950748",
"328621830457408971576313530067804942142",
"136476315436942806948909760712332993137",
"186608332586281970704660856012352119223",
"158460023427168366037576519995551461161",
"306074076703391382033831932573051189088",
"110551635624430856746430526677552243559",
"44609881163532797781931900298759426789",
"43343410791702664993688026274896009318",
"44074261543489698428607497755020739959",
"258692084990588860938688757391270864216",
"75925458710813482488318802113978345174",
"248398106062698723225245398376508743374",
"203419201400327120383377846954525225775",
"200434949374322438810673788499023870031",
"136476315436942806948909760712332993137",
"154919783267435660921595288495506448558",
"67099195536254163879183904522831098223",
"108587633537507210242609878158511307392",
"139695317622413377597846905583937072789",
"298108832666481022864401995374860710408",
"120501377113856357396973326699270228676",
"209106322319566559456555421370640046747",
"117022300649574002542915108907014906378",
"163698965423282611531919811537906056101",
"38375934212153253393265539830941823763",
"75160837033459526394215868554201466184",
"67496912045325639484479633585837097669",
"23148943778385649736188185037366047342",
"136476315436942806948909760712332993137",
"11236932833056520568236915465075281763",
"17839436954179760654658111376708122567",
"96203084739348519890404059298732581589"
],
"threshold": 0.9
},
"target": {
"file": "drivers/net/ethernet/sfc/efx_channels.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059a47f1da93811d37533556d67e72f2261b1127",
"signature_version": "v1",
"deprecated": false
}
]