| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix kernel crash when uninstalling driver\n\nWhen the driver is uninstalled and the VF is disabled concurrently, a\nkernel crash occurs. The reason is that the two actions call function\npci_disable_sriov(). The num_VFs is checked to determine whether to\nrelease the corresponding resources. During the second calling, num_VFs\nis not 0 and the resource release function is called. However, the\ncorresponding resource has been released during the first invoking.\nTherefore, the problem occurs:\n\n[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020\n...\n[15278.131557][T50670] Call trace:\n[15278.134686][T50670] klist_put+0x28/0x12c\n[15278.138682][T50670] klist_del+0x14/0x20\n[15278.142592][T50670] device_del+0xbc/0x3c0\n[15278.146676][T50670] pci_remove_bus_device+0x84/0x120\n[15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80\n[15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c\n[15278.162485][T50670] sriov_disable+0x50/0x11c\n[15278.166829][T50670] pci_disable_sriov+0x24/0x30\n[15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3]\n[15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge]\n[15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230\n[15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30\n[15278.193848][T50670] invoke_syscall+0x50/0x11c\n[15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164\n[15278.203837][T50670] do_el0_svc+0x34/0xcc\n[15278.207834][T50670] el0_svc+0x20/0x30\n\nFor details, see the following figure.\n\n rmmod hclge disable VFs\n----------------------------------------------------\nhclge_exit() sriov_numvfs_store()\n ... device_lock()\n pci_disable_sriov() hns3_pci_sriov_configure()\n pci_disable_sriov()\n sriov_disable()\n sriov_disable() if !num_VFs :\n if !num_VFs : return;\n return; sriov_del_vfs()\n sriov_del_vfs() ...\n ... klist_put()\n klist_put() ...\n ... num_VFs = 0;\n num_VFs = 0; device_unlock();\n\nIn this patch, when driver is removing, we get the device_lock()\nto protect num_VFs, just like sriov_numvfs_store()." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/net/ethernet/hisilicon/hns3/hnae3.c" |
| ], |
| "versions": [ |
| { |
| "version": "b06ad258e01389ca3ff13bc180f3fcd6a608f1cd", |
| "lessThan": "a0df055775f30850c0da8f7dab40d67c0fd63908", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "c4b64011e458aa2b246cd4e42012cfd83d2d9a5c", |
| "lessThan": "7ae4e56de7dbd0999578246a536cf52a63f4056d", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "d36b15e3e7b5937cb1f6ac590a85facc3a320642", |
| "lessThan": "590a4b2d4e0b73586e88bce9b8135b593355ec09", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "0dd8a25f355b4df2d41c08df1716340854c7d4c5", |
| "lessThan": "e36482b222e00cc7aeeea772fc0cf2943590bc4d", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "0dd8a25f355b4df2d41c08df1716340854c7d4c5", |
| "lessThan": "76b155e14d9b182ce83d32ada2d0d7219ea8c8dd", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "0dd8a25f355b4df2d41c08df1716340854c7d4c5", |
| "lessThan": "719edd9f3372ce7fb3b157647c6658672946874b", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "0dd8a25f355b4df2d41c08df1716340854c7d4c5", |
| "lessThan": "b5c94e4d947d15d521e935ff10c5a22a7883dea5", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "0dd8a25f355b4df2d41c08df1716340854c7d4c5", |
| "lessThan": "df3dff8ab6d79edc942464999d06fbaedf8cdd18", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "9b5a29f0acefa3eb1dbe2fa302b393eeff64d933", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/net/ethernet/hisilicon/hns3/hnae3.c" |
| ], |
| "versions": [ |
| { |
| "version": "5.15", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "5.15", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "4.19.324", |
| "lessThanOrEqual": "4.19.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.4.286", |
| "lessThanOrEqual": "5.4.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.10.230", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.172", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.117", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.61", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.11.8", |
| "lessThanOrEqual": "6.11.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.12", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.19.214", |
| "versionEndExcluding": "4.19.324" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.4.156", |
| "versionEndExcluding": "5.4.286" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.10.76", |
| "versionEndExcluding": "5.10.230" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.15", |
| "versionEndExcluding": "5.15.172" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.15", |
| "versionEndExcluding": "6.1.117" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.15", |
| "versionEndExcluding": "6.6.61" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.15", |
| "versionEndExcluding": "6.11.8" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.15", |
| "versionEndExcluding": "6.12" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.14.15" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/a0df055775f30850c0da8f7dab40d67c0fd63908" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/7ae4e56de7dbd0999578246a536cf52a63f4056d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/590a4b2d4e0b73586e88bce9b8135b593355ec09" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/e36482b222e00cc7aeeea772fc0cf2943590bc4d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/76b155e14d9b182ce83d32ada2d0d7219ea8c8dd" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/719edd9f3372ce7fb3b157647c6658672946874b" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/b5c94e4d947d15d521e935ff10c5a22a7883dea5" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/df3dff8ab6d79edc942464999d06fbaedf8cdd18" |
| } |
| ], |
| "title": "net: hns3: fix kernel crash when uninstalling driver", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2024-50296", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
