Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-56759 State: PUBLISHED Published: 2025-01-06T16:20:39.668Z Last Updated: 2025-11-03T20:53:52.637Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf s
that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a
_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1 - https://git.kernel.org/stable/c/526ff5b27f090fb15040471f892cd2c9899ce314 - https://git.kernel.org/stable/c/66376f1a73cba57fd0af2631d7888605b738e499 - https://git.kernel.org/stable/c/9a466b8693b9add05de99af00c7bdff8259e
stable/c/66376f1a73cba57fd0af2631d7888605b738e499 - https://git.kernel.org/stable/c/9a466b8693b9add05de99af00c7bdff8259ecf19 - https://git.kernel.org/stable/c/c3a403d8ce36f5a809a492581de5ad17843e4701 - https://git.kernel.org/stable/c/44f52bbe96dfdbe4aca3818a2534520082a07040
CVE ID: CVE-2024-56760 State: PUBLISHED Published: 2025-01-06T16:20:40.369Z Last Updated: 2025-10-01T20:07:01.138Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Handle lack of irqdomain gracefully Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform which does not provide PCI/MSI support: WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32 __pci_enable_msix_range+0x30c/0x596 pci_msi_setup_msi_irqs+0x2c/0x32 pci_alloc_irq_vectors_affinity+0xb8/0xe2 RISCV uses hierarchical interrupt domains and correctly does not implement the legacy fallback. The warnin
ity+0xb8/0xe2 RISCV uses hierarchical interrupt domains and correctly does not implement the legacy fallback. The warning triggers from the legacy fallback stub. That warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent domain is associated with the device or not. There is a check for MSI-X, which has a legacy assumption. But that legacy fallback assumption is only valid when legacy support is enabled, but otherwise the check should simply return -ENOTSUPP. Loongarch tripped over the same problem and blindly enabled legacy support without implementing the legacy fallbacks. There are weak implementations which return an error, so the problem was papered over. Correct pci_msi_d
gacy fallbacks. There are weak implementations which return an error, so the problem was papered over. Correct pci_msi_domain_supports() to evaluate the legacy mode and add the missing supported check into the MSI enable path to complete it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b1f7476e07b93d65a1a3643dcb4a7bed80d4328d - https://git.kernel.org/stable/c/aed157301c659a48f5564cc4568cf0e5c8831af0 - https://git.kernel.org/stable/c/a60b990798eb17433d0283788280422b1bd94b18
CVE ID: CVE-2024-56761 State: PUBLISHED Published: 2025-01-06T16:20:41.112Z Last Updated: 2025-05-04T10:04:07.795Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU indirect branch tracker (IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted across the instruction boundary. When the decoder finds an inappropriate instruction while WFE is set ENDBR, the CPU raises a #CP fault. For the "kernel IBT no ENDBR" selftest where #CPs are deliberately triggered, the WFE state of the interrupted context needs to be cleared to let execution c
t where #CPs are deliberately triggered, the WFE state of the interrupted context needs to be cleared to let execution continue. Otherwise when the CPU resumes from the instruction that just caused the previous #CP, another missing-ENDBRANCH #CP is raised and the CPU enters a dead loop. This is not a problem with IDT because it doesn't preserve WFE and IRET doesn't set WFE. But FRED provides space on the entry stack (in an expanded CS area) to save and restore the WFE state, thus the WFE state is no longer clobbered, so software must clear it. Clear WFE to avoid dead looping in ibt_clear_fred_wfe() and the !ibt_fatal code path when execution is allowed to continue. Clobbering WFE in any othe
g in ibt_clear_fred_wfe() and the !ibt_fatal code path when execution is allowed to continue. Clobbering WFE in any other circumstance is a security-relevant bug. [ dhansen: changelog rewording ] References: - https://git.kernel.org/stable/c/151447859d6fb0dcce8259f0971c6e94fb801661 - https://git.kernel.org/stable/c/b939f108e86b76119428a6fa4e92491e09ac7867 - https://git.kernel.org/stable/c/dc81e556f2a017d681251ace21bf06c126d5a192
CVE ID: CVE-2024-56762 State: REJECTED Published: 2025-01-06T16:20:41.843Z Last Updated: 2025-01-07T08:48:11.848Z Description: No description available.
CVE ID: CVE-2024-56763 State: PUBLISHED Published: 2025-01-06T16:20:42.530Z Last Updated: 2025-11-03T20:53:55.401Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2558d753df0628d4187d8e1fd989339460f4f364 - https://git.kernel.org/stable/c/f60172b447317cb6c5e74b5601a151866269baf6 - https://git.kernel.org/stable/c/3d15f4c2449558ffe83b4dba30614ef1cd6937c3 - https://git.kernel.org/stabl
a151866269baf6 - https://git.kernel.org/stable/c/3d15f4c2449558ffe83b4dba30614ef1cd6937c3 - https://git.kernel.org/stable/c/03041e474a6a8f1bfd4b96b164bb3165c48fa1a3 - https://git.kernel.org/stable/c/1cca920af19df5dd91254e5ff35e68e911683706 - https://git.kernel.org/stable/c/98feccbf32cfdde8c722bc4587aaa60ee5ac33f0
CVE ID: CVE-2024-56764 State: PUBLISHED Published: 2025-01-06T16:20:43.256Z Last Updated: 2025-05-04T10:04:10.535Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if add_disk() fails Inside ublk_abort_requests(), gendisk is grabbed for aborting all inflight requests. And ublk_abort_requests() is called when exiting the uring context or handling timeout. If add_disk() fails, the gendisk may have been freed when calling ublk_abort_requests(), so use-after-free can be caused when getting disk's reference in ublk_abort_requests(). Fixes the bug by detaching gendisk from ublk device if add_disk()
hen getting disk's reference in ublk_abort_requests(). Fixes the bug by detaching gendisk from ublk device if add_disk() fails. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7d680f2f76a3417fdfc3946da7471e81464f7b41 - https://git.kernel.org/stable/c/75cd4005da5492129917a4a4ee45e81660556104
CVE ID: CVE-2024-56765 State: PUBLISHED Published: 2025-01-06T16:20:43.966Z Last Updated: 2025-11-03T20:53:56.780Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct The mapping VMA address is saved in VAS window struct when the paste address is mapped. This VMA address is used during migration to unmap the paste address if the window is active. The paste address mapping will be removed when the window is closed or with the munmap(). But the VMA address in the VAS window is not updated with munmap() which is causing invalid access during migration. The KASAN report show
s in the VAS window is not updated with munmap() which is causing invalid access during migration. The KASAN report shows: [16386.254991] BUG: KASAN: slab-use-after-free in reconfig_close_windows+0x1a0/0x4e8 [16386.255043] Read of size 8 at addr c00000014a819670 by task drmgr/696928 [16386.255096] CPU: 29 UID: 0 PID: 696928 Comm: drmgr Kdump: loaded Tainted: G B 6.11.0-rc5-nxgzip #2 [16386.255128] Tainted: [B]=BAD_PAGE [16386.255148] Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.00 (NH1110_016) hv:phyp pSeries [16386.255181] Call Trace: [16386.255202] [c00000016b297660] [c0000000018ad0ac] dump_stack_lvl+0x84/0xe8 (unreliable) [16386.255246] [c00000016b297
[16386.255202] [c00000016b297660] [c0000000018ad0ac] dump_stack_lvl+0x84/0xe8 (unreliable) [16386.255246] [c00000016b297690] [c0000000006e8a90] print_report+0x19c/0x764 [16386.255285] [c00000016b297760] [c0000000006e9490] kasan_report+0x128/0x1f8 [16386.255309] [c00000016b297880] [c0000000006eb5c8] __asan_load8+0xac/0xe0 [16386.255326] [c00000016b2978a0] [c00000000013f898] reconfig_close_windows+0x1a0/0x4e8 [16386.255343] [c00000016b297990] [c000000000140e58] vas_migration_handler+0x3a4/0x3fc [16386.255368] [c00000016b297a90] [c000000000128848] pseries_migrate_partition+0x4c/0x4c4 ... [16386.256136] Allocated by task 696554 on cpu 31 at 16377.277618s: [16386.256149] kasan_save_stack+0x34/0x6
c/0x4c4 ... [16386.256136] Allocated by task 696554 on cpu 31 at 16377.277618s: [16386.256149] kasan_save_stack+0x34/0x68 [16386.256163] kasan_save_track+0x34/0x80 [16386.256175] kasan_save_alloc_info+0x58/0x74 [16386.256196] __kasan_slab_alloc+0xb8/0xdc [16386.256209] kmem_cache_alloc_noprof+0x200/0x3d0 [16386.256225] vm_area_alloc+0x44/0x150 [16386.256245] mmap_region+0x214/0x10c4 [16386.256265] do_mmap+0x5fc/0x750 [16386.256277] vm_mmap_pgoff+0x14c/0x24c [16386.256292] ksys_mmap_pgoff+0x20c/0x348 [16386.256303] sys_mmap+0xd0/0x160 ... [16386.256350] Freed by task 0 on cpu 31 at 16386.204848s: [16386.256363] kasan_save_stack+0x34/0x68 [16386.256374] kasan_save_track+0x34/0x80 [16386.256384
u 31 at 16386.204848s: [16386.256363] kasan_save_stack+0x34/0x68 [16386.256374] kasan_save_track+0x34/0x80 [16386.256384] kasan_save_free_info+0x64/0x10c [16386.256396] __kasan_slab_free+0x120/0x204 [16386.256415] kmem_cache_free+0x128/0x450 [16386.256428] vm_area_free_rcu_cb+0xa8/0xd8 [16386.256441] rcu_do_batch+0x2c8/0xcf0 [16386.256458] rcu_core+0x378/0x3c4 [16386.256473] handle_softirqs+0x20c/0x60c [16386.256495] do_softirq_own_stack+0x6c/0x88 [16386.256509] do_softirq_own_stack+0x58/0x88 [16386.256521] __irq_exit_rcu+0x1a4/0x20c [16386.256533] irq_exit+0x20/0x38 [16386.256544] interrupt_async_exit_prepare.constprop.0+0x18/0x2c ... [16386.256717] Last potentially related work creation: [
.256544] interrupt_async_exit_prepare.constprop.0+0x18/0x2c ... [16386.256717] Last potentially related work creation: [16386.256729] kasan_save_stack+0x34/0x68 [16386.256741] __kasan_record_aux_stack+0xcc/0x12c [16386.256753] __call_rcu_common.constprop.0+0x94/0xd04 [16386.256766] vm_area_free+0x28/0x3c [16386.256778] remove_vma+0xf4/0x114 [16386.256797] do_vmi_align_munmap.constprop.0+0x684/0x870 [16386.256811] __vm_munmap+0xe0/0x1f8 [16386.256821] sys_munmap+0x54/0x6c [16386.256830] system_call_exception+0x1a0/0x4a0 [16386.256841] system_call_vectored_common+0x15c/0x2ec [16386.256868] The buggy address belongs to the object at c00000014a819670 which belongs to the cache vm_area_struct of
[16386.256868] The buggy address belongs to the object at c00000014a819670 which belongs to the cache vm_area_struct of size 168 [16386.256887] The buggy address is located 0 bytes inside of freed 168-byte region [c00000014a819670, c00000014a819718) [16386.256915] The buggy address belongs to the physical page: [16386.256928] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a81 [16386.256950] memcg:c0000000ba430001 [16386.256961] anon flags: 0x43ffff800000000(node=4|zone=0|lastcpupid=0x7ffff) [16386.256975] page_type: 0xfdffffff(slab) [16386 ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/s
ed--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8b2282b5084521254a2cd9742a3f4e1d5b77f843 - https://git.kernel.org/stable/c/b7f60ffdfd96f8fc826f1d61a1c6067d828e20b9 - https://git.kernel.org/stable/c/6d9cd27105459f169993a4c5f216499a946dbf34 - https://git.kernel.org/stable/c/05aa156e156ef3168e7ab8a68721945196495c17
CVE ID: CVE-2024-56766 State: PUBLISHED Published: 2025-01-06T16:20:44.676Z Last Updated: 2025-11-03T20:53:59.612Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will lead to a double free. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ca9818554b0f33e87f38e4bfa2dac056692d46cc - https://git.kernel.org/stable/c/1562871ef613fa9492aa0310933eff785166a90e - https://git.kernel.org/stable/c/3d825a241e65
https://git.kernel.org/stable/c/1562871ef613fa9492aa0310933eff785166a90e - https://git.kernel.org/stable/c/3d825a241e65f7e3072978729e79d735ec40b80e - https://git.kernel.org/stable/c/6ea15205d7e2b811fbbdf79783f686f58abfb4b7 - https://git.kernel.org/stable/c/dd45c87782738715d5e7c167f8dabf0814a7394a - https://git.kernel.org/stable/c/d2f090ea57f8d6587e09d4066f740a8617767b3d - https://git.kernel.org/stable/c/d8e4771f99c0400a1873235704b28bb803c83d17
CVE ID: CVE-2024-56767 State: PUBLISHED Published: 2025-01-06T16:20:45.430Z Last Updated: 2025-11-03T20:54:02.496Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will lead to a null pointer dereference. For example, the len input is error, or the atchan->free_descs_list is empty and memory is exhausted. Therefore, add check to avoid this. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/3d229600c54e9e0909080ecaf1aab0642aefa5f0 - https://git.kernel.org/stable
: References: - https://git.kernel.org/stable/c/3d229600c54e9e0909080ecaf1aab0642aefa5f0 - https://git.kernel.org/stable/c/ed1a8aaa344522c0c349ac9042db27ad130ef913 - https://git.kernel.org/stable/c/8d364597de9ce2a5f52714224bfe6c2e7a29b303 - https://git.kernel.org/stable/c/fdba6d5e455388377ec7e82a5913ddfcc7edd93b - https://git.kernel.org/stable/c/e658f1c133b854b2ae799147301d82dddb8f3162 - https://git.kernel.org/stable/c/54376d8d26596f98ed7432a788314bb9154bf3e3 - https://git.kernel.org/stable/c/c43ec96e8d34399bd9dab2f2dc316b904892133f
CVE ID: CVE-2024-56768 State: PUBLISHED Published: 2025-01-06T16:20:46.133Z Last Updated: 2025-10-01T20:07:00.952Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP On x86-64 calling bpf_get_smp_processor_id() in a kernel with CONFIG_SMP disabled can trigger the following bug, as pcpu_hot is unavailable: [ 8.471774] BUG: unable to handle page fault for address: 00000000936a290c [ 8.471849] #PF: supervisor read access in kernel mode [ 8.471881] #PF: error_code(0x0000) - not-present page Fix by inlining a return 0 in the !CONFIG_SMP case. Additional Analyst Notes: - CISA ADP Vulnric
000) - not-present page Fix by inlining a return 0 in the !CONFIG_SMP case. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f4ab7d74247b0150547cf909b3f6f24ee85183df - https://git.kernel.org/stable/c/23579010cf0a12476e96a5f1acdf78a9c5843657
CVE ID: CVE-2024-56769 State: PUBLISHED Published: 2025-01-06T16:20:46.838Z Last Updated: 2025-11-03T20:54:05.601Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1] an uninitialized value issue found by KMSAN in dib3000_read_reg(). Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case that call fails, the buffer may end up with some undefined values. Since no elaborate error handling is expected in dib3000_write_reg(), simply zero out rb buffer to mitigate the problem. [1] Syzkaller report dvb-usb: bulk message failed: -22 (6/0)
_reg(), simply zero out rb buffer to mitigate the problem. [1] Syzkaller report dvb-usb: bulk message failed: -22 (6/0) ===================================================== BUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31 dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290 dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline] dvb_usb_device_init+0x25a8/0x3760 driver
:90 [inline] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline] dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310 dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110 ... Local variable rb created at: dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54 dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 ... Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/035772fcd631eee2756b31cb6df249c0a8d453d7 - https://git.kernel.org/stable/c/e11778189513cd7fb2edced5bd053bc18ede8418 - https://git.kernel.org/stable/c/53106510736e734ce8b731ba871363389bfbf4c9 - htt
11778189513cd7fb2edced5bd053bc18ede8418 - https://git.kernel.org/stable/c/53106510736e734ce8b731ba871363389bfbf4c9 - https://git.kernel.org/stable/c/3876e3a1c31a58a352c6bf5d2a90e3304445a637 - https://git.kernel.org/stable/c/1d6de21f00293d819b5ca6dbe75ff1f3b6392140 - https://git.kernel.org/stable/c/c1197c1457bb7098cf46366e898eb52b41b6876a - https://git.kernel.org/stable/c/2dd59fe0e19e1ab955259978082b62e5751924c7
CVE ID: CVE-2024-56770 State: PUBLISHED Published: 2025-01-08T16:36:59.315Z Last Updated: 2025-11-03T20:54:08.397Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only accounts for the packets in its internal tfifo. When netem is used with a child qdisc, the child qdisc can use 'qdisc_tree_reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function updates 'qlen' and the backlog
reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function updates 'qlen' and the backlog statistics of netem, but netem does not account for changes made by a child qdisc. 'qlen' then indicates the wrong number of packets in the tfifo. If a child qdisc creates new SKBs during enqueue and informs its parent about this, netem's 'qlen' value is increased. When netem dequeues the newly created SKBs from the child, the 'qlen' in netem is not updated. If 'qlen' reaches the configured sch->limit, the enqueue function stops working, even though the tfifo is not full. Reproduce the bug: Ensure that the sender machine has GSO enabled. Configure netem as root qdisc and t
fifo is not full. Reproduce the bug: Ensure that the sender machine has GSO enabled. Configure netem as root qdisc and tbf as its child on the outgoing interface of the machine as follows: $ tc qdisc add dev <oif> root handle 1: netem delay 100ms limit 100 $ tc qdisc add dev <oif> parent 1:0 tbf rate 50Mbit burst 1542 latency 50ms Send bulk TCP traffic out via this interface, e.g., by running an iPerf3 client on the machine. Check the qdisc statistics: $ tc -s qdisc show dev <oif> Statistics after 10s of iPerf3 TCP test before the fix (note that netem's backlog > limit, netem stopped accepting packets): qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped
em stopped accepting packets): qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0 Statistics after the fix: qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0) backlog 0b 0p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0 tbf segments the GSO SKBs (tbf_seg
2 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0 tbf segments the GSO SKBs (tbf_segment) and updates the netem's 'qlen'. The interface fully stops transferring packets and "locks". In this case, the child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at its limit and no more packets are accepted. This patch adds a counter for the entries in the tfifo. Netem's 'qlen' is only decreased when a packet is returned by its dequeue function, and not during enqueuing into the child qdisc. External updates to 'qlen' are thus accounted for and only the behavior of the backlog statistics changes. As in other qdiscs, 'qlen' then keeps track of how many
ed for and only the behavior of the backlog statistics changes. As in other qdiscs, 'qlen' then keeps track of how many packets are held in netem and all of its children. As before, sch->limit remains as the maximum number of packets in the tfifo. The same applies to netem's backlog statistics. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31 - https://git.kernel.org/stable/c/216509dda290f6db92c816dd54b83c1df9da9e76 - https://git.kernel.org/stable/c/c2047b0e216c8edce227d7c42f99ac2877dad0e4 - https://git.kernel.org/stable/c/10df49cfca73dfbbdb6c4150d859f7e8926ae427 - https://git.ke
8edce227d7c42f99ac2877dad0e4 - https://git.kernel.org/stable/c/10df49cfca73dfbbdb6c4150d859f7e8926ae427 - https://git.kernel.org/stable/c/3824c5fad18eeb7abe0c4fc966f29959552dca3e - https://git.kernel.org/stable/c/356078a5c55ec8d2061fcc009fb8599f5b0527f9 - https://git.kernel.org/stable/c/f8d4bc455047cf3903cd6f85f49978987dbb3027