CVE-2021-47127

In the Linux kernel, the following vulnerability has been resolved:

ice: track AF_XDP ZC enabled queues in bitmap

Commit c7a219048e45 (ice: Remove xsk_buff_pool from VSI structure) silently introduced a regression and broke the Tx side of AF_XDP in copy mode. xsk_pool on ice_ring is set only based on the existence of the XDP prog on the VSI which in turn picks ice_clean_tx_irq_zc to be executed. That is not something that should happen for copy mode as it should use the regular data path ice_clean_tx_irq.

This results in a following splat when xdpsock is run in txonly or l2fwd scenarios in copy mode:

Fix this by introducing the bitmap of queues that are zero-copy enabled, where each bit, corresponding to a queue id that xsk pool is being configured on, will be set/cleared within ice_xsk_pool_{en,dis}able and checked within ice_xsk_pool(). The latter is a function used for deciding which napi poll routine is executed. Idea is being taken from our other drivers such as i40e and ixgbe.

Weakness

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/1d34fa4fcf06649036ba0c97854fcf7a741ee18c
• https://git.kernel.org/stable/c/e102db780e1c14f10c70dafa7684af22a745b51d
• https://git.kernel.org/stable/c/1d34fa4fcf06649036ba0c97854fcf7a741ee18c
• https://git.kernel.org/stable/c/e102db780e1c14f10c70dafa7684af22a745b51d