In the Linux kernel, the following vulnerability has been resolved:
net: hns3: fix kernel crash when uninstalling driver
When the driver is uninstalled and the VF is disabled concurrently, a kernel crash occurs. The reason is that the two actions call function pcidisablesriov(). The numVFs is checked to determine whether to release the corresponding resources. During the second calling, numVFs is not 0 and the resource release function is called. However, the corresponding resource has been released during the first invoking. Therefore, the problem occurs:
[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... [15278.131557][T50670] Call trace: [15278.134686][T50670] klistput+0x28/0x12c [15278.138682][T50670] klistdel+0x14/0x20 [15278.142592][T50670] devicedel+0xbc/0x3c0 [15278.146676][T50670] pciremovebusdevice+0x84/0x120 [15278.151714][T50670] pcistopandremovebusdevice+0x6c/0x80 [15278.157447][T50670] pciiovremovevirtfn+0xb4/0x12c [15278.162485][T50670] sriovdisable+0x50/0x11c [15278.166829][T50670] pcidisablesriov+0x24/0x30 [15278.171433][T50670] hnae3unregisteraealgoprepare+0x60/0x90 [hnae3] [15278.178039][T50670] hclgeexit+0x28/0xd0 [hclge] [15278.182730][T50670] _sesysdeletemodule.isra.0+0x164/0x230 [15278.188550][T50670] _arm64sysdeletemodule+0x1c/0x30 [15278.193848][T50670] invokesyscall+0x50/0x11c [15278.198278][T50670] el0svccommon.constprop.0+0x158/0x164 [15278.203837][T50670] doel0svc+0x34/0xcc [15278.207834][T50670] el0svc+0x20/0x30
For details, see the following figure.
hclgeexit() sriovnumvfsstore() ... devicelock() pcidisablesriov() hns3pcisriovconfigure() pcidisablesriov() sriovdisable() sriovdisable() if !numVFs : if !numVFs : return; return; sriovdelvfs() sriovdelvfs() ... ... klistput() klistput() ... ... numVFs = 0; numVFs = 0; deviceunlock();
In this patch, when driver is removing, we get the devicelock() to protect numVFs, just like sriovnumvfsstore().
[
{
"id": "CVE-2024-50296-0937b665",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0df055775f30850c0da8f7dab40d67c0fd63908",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c",
"function": "hnae3_unregister_ae_algo_prepare"
},
"deprecated": false,
"digest": {
"length": 365.0,
"function_hash": "260562975103020648668879969113105546459"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-20fa9f3d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@590a4b2d4e0b73586e88bce9b8135b593355ec09",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c",
"function": "hnae3_unregister_ae_algo_prepare"
},
"deprecated": false,
"digest": {
"length": 365.0,
"function_hash": "260562975103020648668879969113105546459"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-2326c08f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ae4e56de7dbd0999578246a536cf52a63f4056d",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c",
"function": "hnae3_unregister_ae_algo_prepare"
},
"deprecated": false,
"digest": {
"length": 365.0,
"function_hash": "260562975103020648668879969113105546459"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-255af75e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e36482b222e00cc7aeeea772fc0cf2943590bc4d",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c",
"function": "hnae3_unregister_ae_algo_prepare"
},
"deprecated": false,
"digest": {
"length": 365.0,
"function_hash": "260562975103020648668879969113105546459"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-43ead0c4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@590a4b2d4e0b73586e88bce9b8135b593355ec09",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"43925250307660247248104520581717804401",
"257621574720057910775583453239528240658",
"3622877908281384167908773821389316885",
"338348410144527411502272332767050378462",
"106168629590125287995541112936587141822"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-601e01ce",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df3dff8ab6d79edc942464999d06fbaedf8cdd18",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c",
"function": "hnae3_unregister_ae_algo_prepare"
},
"deprecated": false,
"digest": {
"length": 365.0,
"function_hash": "260562975103020648668879969113105546459"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-63197bbe",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76b155e14d9b182ce83d32ada2d0d7219ea8c8dd",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"43925250307660247248104520581717804401",
"257621574720057910775583453239528240658",
"3622877908281384167908773821389316885",
"338348410144527411502272332767050378462",
"106168629590125287995541112936587141822"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-72902f8c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ae4e56de7dbd0999578246a536cf52a63f4056d",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"43925250307660247248104520581717804401",
"257621574720057910775583453239528240658",
"3622877908281384167908773821389316885",
"338348410144527411502272332767050378462",
"106168629590125287995541112936587141822"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-74c2586d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c94e4d947d15d521e935ff10c5a22a7883dea5",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"43925250307660247248104520581717804401",
"257621574720057910775583453239528240658",
"3622877908281384167908773821389316885",
"338348410144527411502272332767050378462",
"106168629590125287995541112936587141822"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-8c436a80",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e36482b222e00cc7aeeea772fc0cf2943590bc4d",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"43925250307660247248104520581717804401",
"257621574720057910775583453239528240658",
"3622877908281384167908773821389316885",
"338348410144527411502272332767050378462",
"106168629590125287995541112936587141822"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-91c08423",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0df055775f30850c0da8f7dab40d67c0fd63908",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"43925250307660247248104520581717804401",
"257621574720057910775583453239528240658",
"3622877908281384167908773821389316885",
"338348410144527411502272332767050378462",
"106168629590125287995541112936587141822"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-a47153f3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76b155e14d9b182ce83d32ada2d0d7219ea8c8dd",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c",
"function": "hnae3_unregister_ae_algo_prepare"
},
"deprecated": false,
"digest": {
"length": 365.0,
"function_hash": "260562975103020648668879969113105546459"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-a7eac6e1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c94e4d947d15d521e935ff10c5a22a7883dea5",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c",
"function": "hnae3_unregister_ae_algo_prepare"
},
"deprecated": false,
"digest": {
"length": 365.0,
"function_hash": "260562975103020648668879969113105546459"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-50296-b2f4d21a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df3dff8ab6d79edc942464999d06fbaedf8cdd18",
"target": {
"file": "drivers/net/ethernet/hisilicon/hns3/hnae3.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"43925250307660247248104520581717804401",
"257621574720057910775583453239528240658",
"3622877908281384167908773821389316885",
"338348410144527411502272332767050378462",
"106168629590125287995541112936587141822"
],
"threshold": 0.9
},
"signature_version": "v1"
}
]