In the Linux kernel, the following vulnerability has been resolved:
net: sfc: add missing xdp queue reinitialization
After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDPTX or XDPREDIRECT.
When tx/rx ring buffer size is changed(ethtool -G), sfc driver reallocates and reinitializes rx and tx queues and their buffer (txqueue->buffer). But it misses reinitializing xdp queues(efx->xdptxqueues). So, while it is acting XDPTX or XDPREDIRECT, it uses the uninitialized txqueue->buffer.
A new function efxsetxdpchannels() is separated from efxset_channels() to handle only xdp queues.
Splat looks like: BUG: kernel NULL pointer dereference, address: 000000000000002a #PF: supervisor write access in kernel mode #PF: errorcode(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#4] PREEMPT SMP NOPTI RIP: 0010:efxtxmapchunk+0x54/0x90 [sfc] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D 5.17.0+ #55 e8beeee8289528f11357029357cf Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297 RIP: 0010:efxtxmapchunk+0x54/0x90 [sfc] RAX: 0000000000000040 RBX: ffff92ea506895c0 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001139b10ce RDI: ffff92ea506895c0 RBP: ffffffffc0358a80 R08: 00000001139b110d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001139b10ce R15: ffff92ea506895c0 FS: 0000000000000000(0000) GS:ffff92f121ec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 CR2: 000000000000002a CR3: 00000003e6810004 CR4: 00000000007706e0 RSP: 0018:ffff92f121e85c60 EFLAGS: 00010297 PKRU: 55555554 RAX: 0000000000000040 RBX: ffff92ea50689700 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001145a90ce RDI: ffff92ea50689700 RBP: ffffffffc0358a80 R08: 00000001145a910d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001145a90ce R15: ffff92ea50689700 FS: 0000000000000000(0000) GS:ffff92f121e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002a CR3: 00000003e6810005 CR4: 00000000007706e0 PKRU: 55555554 Call Trace: <IRQ> efxxdptxbuffers+0x12b/0x3d0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] _efxrxpacket+0x5c3/0x930 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efxrxpacket+0x28c/0x2e0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efxef10evprocess+0x5f8/0xf40 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] ? enqueuetaskfair+0x95/0x550 efx_poll+0xc4/0x360 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5]
[ { "signature_type": "Function", "id": "CVE-2022-49096-07e84f5e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc85e1593686e42c6749ef3d356db34759d59e8", "signature_version": "v1", "target": { "function": "efx_set_xdp_tx_queue", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "294420847401716680371765845589882598302", "length": 355.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-0fbb12c2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7a824fda8732578d1014fad1f7fb0363705090", "signature_version": "v1", "target": { "function": "efx_realloc_channels", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "123990933910201860215863513944750245823", "length": 2090.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-12174433", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8c46bc358d84701e7f7ffa054037db25f25da0e", "signature_version": "v1", "target": { "function": "efx_set_xdp_tx_queue", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "294420847401716680371765845589882598302", "length": 355.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-1d348e37", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059a47f1da93811d37533556d67e72f2261b1127", "signature_version": "v1", "target": { "function": "efx_realloc_channels", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "425764762611842702399717516804274634", "length": 2010.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-2d2707e4", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059a47f1da93811d37533556d67e72f2261b1127", "signature_version": "v1", "target": { "function": "efx_set_channels", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "200554917988213636075326213820697093040", "length": 1766.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-40d7229b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7a824fda8732578d1014fad1f7fb0363705090", "signature_version": "v1", "target": { "function": "efx_set_xdp_tx_queue", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "294420847401716680371765845589882598302", "length": 355.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-58560e8b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc85e1593686e42c6749ef3d356db34759d59e8", "signature_version": "v1", "target": { "function": "efx_set_channels", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "200554917988213636075326213820697093040", "length": 1766.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-6f8ba105", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059a47f1da93811d37533556d67e72f2261b1127", "signature_version": "v1", "target": { "function": "efx_set_xdp_tx_queue", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "294420847401716680371765845589882598302", "length": 355.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-8dc3cf52", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc85e1593686e42c6749ef3d356db34759d59e8", "signature_version": "v1", "target": { "function": "efx_realloc_channels", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "425764762611842702399717516804274634", "length": 2010.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-9517d2e7", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8c46bc358d84701e7f7ffa054037db25f25da0e", "signature_version": "v1", "target": { "function": "efx_set_channels", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "200554917988213636075326213820697093040", "length": 1766.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-9d56cf37", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8c46bc358d84701e7f7ffa054037db25f25da0e", "signature_version": "v1", "target": { "function": "efx_realloc_channels", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "123990933910201860215863513944750245823", "length": 2090.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49096-9fed2d68", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc85e1593686e42c6749ef3d356db34759d59e8", "signature_version": "v1", "target": { "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "314456574570319593615914515917961386505", "318282386433591174019200173817323181400", "130728210181493507027015461958238203479", "280950587304234922259839524221791483959", "310821467293002033740676730151188959148", "112812141080351992534497989177321782361", "210274722111188715331718929643241348053", "199046487086778756126482733303355775535", "251361381997223867684530108886323175307", "260832987654518994228421990531701758135", "272903385020709666692056562730452017965", "89014616945471759686033325811006747619", "178452915517746289902911093895836732115", "52509756766964357127915047019019521190", "126975896322264436996245743805364022848", "44287848373346077112603953331819510680", "197697270556182762544271351702678253511", "74831815742778634445740974018208254875", "280748308240013033905410684241712361010", "79516361563074297262445395735305766528", "42481612471190476629745028525522140156", "61309894743467017293427455878015945607", "30600765917714702766498611522020189955", "154144629066437654919719269089181855944", "178710273345924690865013355924822323477", "217577207695821045744669227484385847816", "150242443131833083510737984887447875333", "212358768674074814632403362695451718056", "3616480090664483972580439972141009189", "226353490112122657577838201588599752471", "276198033888644418908939971515539021768", "53773542899053505705672511422875595903", "2033921690943061536890140750761465985", "281369403363874719969158997364921728080", "7125343498576563920095020183650555069", "19374703588385360742773903578240928796", "108882020833305702975594007600309719547", "263358787105420934341717383225083331421", "158573873128147146870291931760704950748", "328621830457408971576313530067804942142", "136476315436942806948909760712332993137", "186608332586281970704660856012352119223", "158460023427168366037576519995551461161", "306074076703391382033831932573051189088", "110551635624430856746430526677552243559", "44609881163532797781931900298759426789", "43343410791702664993688026274896009318", "44074261543489698428607497755020739959", "258692084990588860938688757391270864216", "75925458710813482488318802113978345174", "248398106062698723225245398376508743374", "203419201400327120383377846954525225775", "200434949374322438810673788499023870031", "136476315436942806948909760712332993137", "154919783267435660921595288495506448558", "67099195536254163879183904522831098223", "108587633537507210242609878158511307392", "139695317622413377597846905583937072789", "298108832666481022864401995374860710408", "120501377113856357396973326699270228676", "209106322319566559456555421370640046747", "117022300649574002542915108907014906378", "163698965423282611531919811537906056101", "38375934212153253393265539830941823763", "75160837033459526394215868554201466184", "67496912045325639484479633585837097669", "23148943778385649736188185037366047342", "136476315436942806948909760712332993137", "11236932833056520568236915465075281763", "17839436954179760654658111376708122567", "96203084739348519890404059298732581589" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49096-b5b19b7b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7a824fda8732578d1014fad1f7fb0363705090", "signature_version": "v1", "target": { "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "314456574570319593615914515917961386505", "318282386433591174019200173817323181400", "130728210181493507027015461958238203479", "280950587304234922259839524221791483959", "310821467293002033740676730151188959148", "112812141080351992534497989177321782361", "49621976000807743501698389766360848395", "199046487086778756126482733303355775535", "251361381997223867684530108886323175307", "260832987654518994228421990531701758135", "272903385020709666692056562730452017965", "89014616945471759686033325811006747619", "178452915517746289902911093895836732115", "52509756766964357127915047019019521190", "126975896322264436996245743805364022848", "44287848373346077112603953331819510680", "197697270556182762544271351702678253511", "74831815742778634445740974018208254875", "280748308240013033905410684241712361010", "79516361563074297262445395735305766528", "42481612471190476629745028525522140156", "61309894743467017293427455878015945607", "30600765917714702766498611522020189955", "154144629066437654919719269089181855944", "178710273345924690865013355924822323477", "217577207695821045744669227484385847816", "150242443131833083510737984887447875333", "212358768674074814632403362695451718056", "3616480090664483972580439972141009189", "226353490112122657577838201588599752471", "276198033888644418908939971515539021768", "53773542899053505705672511422875595903", "2033921690943061536890140750761465985", "281369403363874719969158997364921728080", "7125343498576563920095020183650555069", "19374703588385360742773903578240928796", "108882020833305702975594007600309719547", "263358787105420934341717383225083331421", "158573873128147146870291931760704950748", "328621830457408971576313530067804942142", "136476315436942806948909760712332993137", "186608332586281970704660856012352119223", "158460023427168366037576519995551461161", "306074076703391382033831932573051189088", "110551635624430856746430526677552243559", "44609881163532797781931900298759426789", "43343410791702664993688026274896009318", "44074261543489698428607497755020739959", "258692084990588860938688757391270864216", "75925458710813482488318802113978345174", "248398106062698723225245398376508743374", "203419201400327120383377846954525225775", "200434949374322438810673788499023870031", "136476315436942806948909760712332993137", "154919783267435660921595288495506448558", "67099195536254163879183904522831098223", "108587633537507210242609878158511307392", "139695317622413377597846905583937072789", "298108832666481022864401995374860710408", "120501377113856357396973326699270228676", "209106322319566559456555421370640046747", "117022300649574002542915108907014906378", "163698965423282611531919811537906056101", "38375934212153253393265539830941823763", "75160837033459526394215868554201466184", "67496912045325639484479633585837097669", "23148943778385649736188185037366047342", "136476315436942806948909760712332993137", "11236932833056520568236915465075281763", "17839436954179760654658111376708122567", "96203084739348519890404059298732581589" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49096-cd6d6876", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7a824fda8732578d1014fad1f7fb0363705090", "signature_version": "v1", "target": { "function": "efx_set_channels", "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "function_hash": "200554917988213636075326213820697093040", "length": 1766.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49096-e7868a25", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8c46bc358d84701e7f7ffa054037db25f25da0e", "signature_version": "v1", "target": { "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "314456574570319593615914515917961386505", "318282386433591174019200173817323181400", "130728210181493507027015461958238203479", "280950587304234922259839524221791483959", "310821467293002033740676730151188959148", "112812141080351992534497989177321782361", "49621976000807743501698389766360848395", "199046487086778756126482733303355775535", "251361381997223867684530108886323175307", "260832987654518994228421990531701758135", "272903385020709666692056562730452017965", "89014616945471759686033325811006747619", "178452915517746289902911093895836732115", "52509756766964357127915047019019521190", "126975896322264436996245743805364022848", "44287848373346077112603953331819510680", "197697270556182762544271351702678253511", "74831815742778634445740974018208254875", "280748308240013033905410684241712361010", "79516361563074297262445395735305766528", "42481612471190476629745028525522140156", "61309894743467017293427455878015945607", "30600765917714702766498611522020189955", "154144629066437654919719269089181855944", "178710273345924690865013355924822323477", "217577207695821045744669227484385847816", "150242443131833083510737984887447875333", "212358768674074814632403362695451718056", "3616480090664483972580439972141009189", "226353490112122657577838201588599752471", "276198033888644418908939971515539021768", "53773542899053505705672511422875595903", "2033921690943061536890140750761465985", "281369403363874719969158997364921728080", "7125343498576563920095020183650555069", "19374703588385360742773903578240928796", "108882020833305702975594007600309719547", "263358787105420934341717383225083331421", "158573873128147146870291931760704950748", "328621830457408971576313530067804942142", "136476315436942806948909760712332993137", "186608332586281970704660856012352119223", "158460023427168366037576519995551461161", "306074076703391382033831932573051189088", "110551635624430856746430526677552243559", "44609881163532797781931900298759426789", "43343410791702664993688026274896009318", "44074261543489698428607497755020739959", "258692084990588860938688757391270864216", "75925458710813482488318802113978345174", "248398106062698723225245398376508743374", "203419201400327120383377846954525225775", "200434949374322438810673788499023870031", "136476315436942806948909760712332993137", "154919783267435660921595288495506448558", "67099195536254163879183904522831098223", "108587633537507210242609878158511307392", "139695317622413377597846905583937072789", "298108832666481022864401995374860710408", "120501377113856357396973326699270228676", "209106322319566559456555421370640046747", "117022300649574002542915108907014906378", "163698965423282611531919811537906056101", "38375934212153253393265539830941823763", "75160837033459526394215868554201466184", "67496912045325639484479633585837097669", "23148943778385649736188185037366047342", "136476315436942806948909760712332993137", "11236932833056520568236915465075281763", "17839436954179760654658111376708122567", "96203084739348519890404059298732581589" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49096-f9cea776", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059a47f1da93811d37533556d67e72f2261b1127", "signature_version": "v1", "target": { "file": "drivers/net/ethernet/sfc/efx_channels.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "314456574570319593615914515917961386505", "318282386433591174019200173817323181400", "130728210181493507027015461958238203479", "280950587304234922259839524221791483959", "310821467293002033740676730151188959148", "112812141080351992534497989177321782361", "210274722111188715331718929643241348053", "199046487086778756126482733303355775535", "251361381997223867684530108886323175307", "260832987654518994228421990531701758135", "272903385020709666692056562730452017965", "89014616945471759686033325811006747619", "178452915517746289902911093895836732115", "52509756766964357127915047019019521190", "126975896322264436996245743805364022848", "44287848373346077112603953331819510680", "197697270556182762544271351702678253511", "74831815742778634445740974018208254875", "280748308240013033905410684241712361010", "79516361563074297262445395735305766528", "42481612471190476629745028525522140156", "61309894743467017293427455878015945607", "30600765917714702766498611522020189955", "154144629066437654919719269089181855944", "178710273345924690865013355924822323477", "217577207695821045744669227484385847816", "150242443131833083510737984887447875333", "212358768674074814632403362695451718056", "3616480090664483972580439972141009189", "226353490112122657577838201588599752471", "276198033888644418908939971515539021768", "53773542899053505705672511422875595903", "2033921690943061536890140750761465985", "281369403363874719969158997364921728080", "7125343498576563920095020183650555069", "19374703588385360742773903578240928796", "108882020833305702975594007600309719547", "263358787105420934341717383225083331421", "158573873128147146870291931760704950748", "328621830457408971576313530067804942142", "136476315436942806948909760712332993137", "186608332586281970704660856012352119223", "158460023427168366037576519995551461161", "306074076703391382033831932573051189088", "110551635624430856746430526677552243559", "44609881163532797781931900298759426789", "43343410791702664993688026274896009318", "44074261543489698428607497755020739959", "258692084990588860938688757391270864216", "75925458710813482488318802113978345174", "248398106062698723225245398376508743374", "203419201400327120383377846954525225775", "200434949374322438810673788499023870031", "136476315436942806948909760712332993137", "154919783267435660921595288495506448558", "67099195536254163879183904522831098223", "108587633537507210242609878158511307392", "139695317622413377597846905583937072789", "298108832666481022864401995374860710408", "120501377113856357396973326699270228676", "209106322319566559456555421370640046747", "117022300649574002542915108907014906378", "163698965423282611531919811537906056101", "38375934212153253393265539830941823763", "75160837033459526394215868554201466184", "67496912045325639484479633585837097669", "23148943778385649736188185037366047342", "136476315436942806948909760712332993137", "11236932833056520568236915465075281763", "17839436954179760654658111376708122567", "96203084739348519890404059298732581589" ] }, "deprecated": false } ]