In the Linux kernel, the following vulnerability has been resolved: ice: Fix deinitializing VF in error path If iceenavfs() fails after calling icecreatevfentries(), it frees all VFs without removing them from snapshot PF-VF mailbox list, leading to list corruption. Reproducer: devlink dev eswitch set $PF1PCI mode switchdev ip l s $PF1 up ip l s $PF1 promisc on sleep 1 echo 1 > /sys/class/net/$PF1/device/sriovnumvfs sleep 1 echo 1 > /sys/class/net/$PF1/device/sriovnumvfs Trace (minimized): listadd corruption. next->prev should be prev (ffff8882e241c6f0), but was 0000000000000000. (next=ffff888455da1330). kernel BUG at lib/listdebug.c:29! RIP: 0010:_listaddvalidorreport+0xa6/0x100 icembxinitvfinfo+0xa7/0x180 [ice] iceinitializevfentry+0x1fa/0x250 [ice] icesriovconfigure+0x8d7/0x1520 [ice] ? _percpurefswitchmode+0x1b1/0x5d0 ? _pfxicesriovconfigure+0x10/0x10 [ice] Sometimes a KASAN report can be seen instead with a similar stack trace: BUG: KASAN: use-after-free in _listaddvalidorreport+0xf1/0x100 VFs are added to this list in icembxinitvfinfo(), but only removed in icefreevfs(). Move the removing to icefreevfentries(), which is also being called in other places where VFs are being removed (including icefreevfs() itself).
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-cloud-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-headers-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-azure-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-azure" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-headers-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-lib-rust-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-gcp-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-buildinfo-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-buildinfo-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-headers-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-headers-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-headers-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-tools-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-6.11.0-26-generic-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-extra-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-ipu6-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-ipu7-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-usbio-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-vision-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-tools-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-tools-6.11.0-26-generic-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-headers-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-headers-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-cloud-tools-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-headers-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-lib-rust-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-tools-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-tools-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-tools-6.11.0-1014-lowlatency-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1022.22", "binary_name": "linux-buildinfo-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-headers-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-image-unsigned-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-image-unsigned-6.11.0-1022-oem-dbgsym" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-ipu6-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-ipu7-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-iwlwifi-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-usbio-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-vision-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-oem-6.11-headers-6.11.0-1022" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-oem-6.11-tools-6.11.0-1022" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-tools-6.11.0-1022-oem" } ] }