CVE-2021-47399

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup<br /> <br /> The ixgbe driver currently generates a NULL pointer dereference with<br /> some machine (online cpus num_rx_queues = rss_i;<br /> adapter-&gt;num_tx_queues = rss_i;<br /> adapter-&gt;num_xdp_queues = ixgbe_xdp_queues(adapter);<br /> <br /> And rss_i&amp;#39;s value is from<br /> f = &amp;adapter-&gt;ring_feature[RING_F_FDIR];<br /> rss_i = f-&gt;indices = f-&gt;limit;<br /> <br /> So "num_rx_queues" &gt; "num_xdp_queues", when run to "ixgbe_xdp_setup",<br /> for (i = 0; i num_rx_queues; i++)<br /> if (adapter-&gt;xdp_ring[i]-&gt;xsk_umem)<br /> <br /> It leads to panic.<br /> <br /> Call trace:<br /> [exception RIP: ixgbe_xdp+368]<br /> RIP: ffffffffc02a76a0 RSP: ffff9fe16202f8d0 RFLAGS: 00010297<br /> RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000<br /> RDX: 0000000000000000 RSI: 000000000000001c RDI: ffffffffa94ead90<br /> RBP: ffff92f8f24c0c18 R8: 0000000000000000 R9: 0000000000000000<br /> R10: ffff9fe16202f830 R11: 0000000000000000 R12: ffff92f8f24c0000<br /> R13: ffff9fe16202fc01 R14: 000000000000000a R15: ffffffffc02a7530<br /> ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018<br /> 7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc<br /> 8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808<br /> 9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235<br /> 10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384<br /> 11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd<br /> 12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb<br /> 13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88<br /> 14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319<br /> 15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290<br /> 16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8<br /> 17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64<br /> 18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9<br /> 19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c<br /> <br /> So I fix ixgbe_max_channels so that it will not allow a setting of queues<br /> to be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup,<br /> take the smaller value of num_rx_queues and num_xdp_queues.