CVE: CVE-2022-49096
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: sfc: add missing xdp queue reinitialization

After rx/tx ring buffer size is changed, kernel panic occurs when
it acts XDP_TX or XDP_REDIRECT.

When tx/rx ring buffer size is changed(ethtool -G), sfc driver
reallocates and reinitializes rx and tx queues and their buffer
(tx_queue->buffer).
But it misses reinitializing xdp queues(efx->xdp_tx_queues).
So, while it is acting XDP_TX or XDP_REDIRECT, it uses the uninitialized
tx_queue->buffer.

A new function efx_set_xdp_channels() is separated from efx_set_channels()
to handle only xdp queues.

Splat looks like:
   BUG: kernel NULL pointer dereference, address:[PII_REDACTED]00002a
   #PF: supervisor write access in kernel mode
   #PF: error_code(0x0002) - not-present page
   PGD 0 P4D 0
   Oops: 0002 [#4] PREEMPT SMP NOPTI
   RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc]
   CPU: 2 PID: 0 Comm: swapper/2 Tainted: G      D           5.17.0+ #55 e8beeee8289528f[PII_REDACTED]cf
   Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80
   RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297
   RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc]
   RAX: [PII_REDACTED] RBX: ffff92ea506895c0 RCX: ffffffffc0330870
   RDX: [PII_REDACTED] RSI:[PII_REDACTED]9b10ce RDI: ffff92ea506895c0
   RBP: ffffffffc0358a80 R08:[PII_REDACTED]9b110d R09: [PII_REDACTED]
   R10: [PII_REDACTED] R11: ffff92ea414c0088 R12: [PII_REDACTED]
   R13: [PII_REDACTED] R14:[PII_REDACTED]9b10ce R15: ffff92ea506895c0
   FS:  [PII_REDACTED](0000) GS:ffff92f121ec0000(0000) knlGS:[PII_REDACTED]
   CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
   Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80
   CR2:[PII_REDACTED]00002a CR3: 00000003e6810004 CR4:[PII_REDACTED]7706e0
   RSP: 0018:ffff92f121e85c60 EFLAGS: 00010297
   PKRU: 55555554
   RAX: [PII_REDACTED] RBX: ffff92ea50689700 RCX: ffffffffc0330870
   RDX: [PII_REDACTED] RSI:[PII_REDACTED]5a90ce RDI: ffff92ea50689700
   RBP: ffffffffc0358a80 R08:[PII_REDACTED]5a910d R09: [PII_REDACTED]
   R10: [PII_REDACTED] R11: ffff92ea414c0088 R12: [PII_REDACTED]
   R13: [PII_REDACTED] R14:[PII_REDACTED]5a90ce R15: ffff92ea50689700
   FS:  [PII_REDACTED](0000) GS:ffff92f121e80000(0000) knlGS:[PII_REDACTED]
   CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
   CR2:[PII_REDACTED]00002a CR3: 00000003e6810005 CR4:[PII_REDACTED]7706e0
   PKRU: 55555554
   Call Trace:
    <IRQ>
    efx_xdp_tx_buffers+0x12b/0x3d0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5]
    __efx_rx_packet+0x5c3/0x930 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5]
    efx_rx_packet+0x28c/0x2e0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5]
    efx_ef10_ev_process+0x5f8/0xf40 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5]
    ? enqueue_task_fair+0x95/0x550
    efx_poll+0xc4/0x360 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/059a47f1da93811d37533556d67e72f2261b1127; https://git.kernel.org/stable/c/b8c46bc358d84701e7f7ffa054037db25f25da0e; https://git.kernel.org/stable/c/dcc85e1593686e42c6749ef3d356db34759d59e8