CVE: CVE-2024-26611
Published: 2024-03-11
Description: In the Linux kernel, the following vulnerability has been resolved:

xsk: fix usage of multi-buffer BPF helpers for ZC XDP

Currently when packet is shrunk via bpf_xdp_adjust_tail() and memory
type is set to MEM_TYPE_XSK_BUFF_POOL, null ptr dereference happens:

[[PII_REDACTED]56] BUG: kernel NULL pointer dereference, address:
[PII_REDACTED]
[[PII_REDACTED]43] #PF: supervisor read access in kernel mode
[[PII_REDACTED]68] #PF: error_code(0x0000) - not-present page
[[PII_REDACTED]50] PGD 0 P4D 0
[[PII_REDACTED]84] Oops: 0000 [#1] PREEMPT SMP NOPTI
[[PII_REDACTED]21] CPU: 8 PID: 54203 Comm: xdpsock Not tainted 6.6.0+ #257
[[PII_REDACTED]69] Hardware name: Intel Corporation S2600WFT/S2600WFT,
BIOS SE5C620.86B.02.01.0[PII_REDACTED]91559 03/19/2019
[[PII_REDACTED]15] RIP: 0010:__xdp_return+0x6c/0x210
[[PII_REDACTED]53] Code: ad 00 48 8b 47 08 49 89 f8 a8 01 0f 85 9b 01 00 00 0f 1f 44 00 00 f0 41 ff 48 34 75 32 4c 89 c7 e9 79 cd 80 ff 83 fe 03 75 17 <f6> 41 34 01 0f 85 02 01 00 00 48 89 cf e9 22 cc 1e 00 e9 3d d2 86
[[PII_REDACTED]07] RSP: 0018:ffffc900089f8db0 EFLAGS: 00010246
[[PII_REDACTED]67] RAX: ffffc9003168aed0 RBX: ffff8881c3300000 RCX:
[PII_REDACTED]
[[PII_REDACTED]53] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI:
ffffc9003168c000
[[PII_REDACTED]29] RBP:[PII_REDACTED]000ae0 R08: [PII_REDACTED] R09:
[PII_REDACTED]
[[PII_REDACTED]44] R10: ffffc9000e495000 R11: [PII_REDACTED] R12:
[PII_REDACTED]
[[PII_REDACTED]06] R13: [PII_REDACTED] R14: ffffc9003168aec0 R15:
[PII_REDACTED]
[[PII_REDACTED]98] FS:  00007f8df8bbcb80(0000) GS:ffff8897e0e00000(0000)
knlGS:[PII_REDACTED]
[[PII_REDACTED]05] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[[PII_REDACTED]32] CR2: [PII_REDACTED] CR3: 00000001aa912002 CR4:[PII_REDACTED]7706f0
[[PII_REDACTED]77] DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2:
[PII_REDACTED]
[[PII_REDACTED]73] DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7:
[PII_REDACTED]
[[PII_REDACTED]90] PKRU: 55555554
[[PII_REDACTED]43] Call Trace:
[[PII_REDACTED]58]  <IRQ>
[[PII_REDACTED]65]  ? __die+0x20/0x70
[[PII_REDACTED]81]  ? page_fault_oops+0x15b/0x440
[[PII_REDACTED]05]  ? exc_page_fault+0x6a/0x150
[[PII_REDACTED]91]  ? asm_exc_page_fault+0x22/0x30
[[PII_REDACTED]27]  ? __xdp_return+0x6c/0x210
[[PII_REDACTED]63]  bpf_xdp_adjust_tail+0x155/0x1d0
[[PII_REDACTED]69]  bpf_prog_ccc47ae29d3b6570_xdp_sock_prog+0x15/0x60
[[PII_REDACTED]63]  ice_clean_rx_irq_zc+0x206/0xc60 [ice]
[[PII_REDACTED]22]  ? ice_xmit_zc+0x6e/0x150 [ice]
[[PII_REDACTED]06]  ice_napi_poll+0x467/0x670 [ice]
[[PII_REDACTED]58]  ? ttwu_do_activate.constprop.0+0x8f/0x1a0
[[PII_REDACTED]10]  __napi_poll+0x29/0x1b0
[[PII_REDACTED]62]  net_rx_action+0x133/0x270
[[PII_REDACTED]19]  __do_softirq+0xbe/0x28e
[[PII_REDACTED]03]  do_softirq+0x3f/0x60

This comes from __xdp_return() call with xdp_buff argument passed as
NULL which is supposed to be consumed by xsk_buff_free() call.

To address this properly, in ZC case, a node that represents the frag
being removed has to be pulled out of xskb_list. Introduce
appropriate xsk helpers to do such node operation and use them
accordingly within bpf_xdp_adjust_tail().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/5cd781f7216f980207af09c5e0e1bb1eda284540; https://git.kernel.org/stable/c/82ee4781b8200e44669a354140d5c6bd966b8768; https://git.kernel.org/stable/c/c5114710c8ce86b8317e9b448f4fd15c711c2a82