CVE-2024-26953

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: esp: fix bad handling of pages from page_pool<br /> <br /> When the skb is reorganized during esp_output (!esp-&gt;inline), the pages<br /> coming from the original skb fragments are supposed to be released back<br /> to the system through put_page. But if the skb fragment pages are<br /> originating from a page_pool, calling put_page on them will trigger a<br /> page_pool leak which will eventually result in a crash.<br /> <br /> This leak can be easily observed when using CONFIG_DEBUG_VM and doing<br /> ipsec + gre (non offloaded) forwarding:<br /> <br /> BUG: Bad page state in process ksoftirqd/16 pfn:1451b6<br /> page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6<br /> flags: 0x200000000000000(node=0|zone=2)<br /> page_type: 0xffffffff()<br /> raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000<br /> raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000<br /> page dumped because: page_pool leak<br /> Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]<br /> CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x36/0x50<br /> bad_page+0x70/0xf0<br /> free_unref_page_prepare+0x27a/0x460<br /> free_unref_page+0x38/0x120<br /> esp_ssg_unref.isra.0+0x15f/0x200<br /> esp_output_tail+0x66d/0x780<br /> esp_xmit+0x2c5/0x360<br /> validate_xmit_xfrm+0x313/0x370<br /> ? validate_xmit_skb+0x1d/0x330<br /> validate_xmit_skb_list+0x4c/0x70<br /> sch_direct_xmit+0x23e/0x350<br /> __dev_queue_xmit+0x337/0xba0<br /> ? nf_hook_slow+0x3f/0xd0<br /> ip_finish_output2+0x25e/0x580<br /> iptunnel_xmit+0x19b/0x240<br /> ip_tunnel_xmit+0x5fb/0xb60<br /> ipgre_xmit+0x14d/0x280 [ip_gre]<br /> dev_hard_start_xmit+0xc3/0x1c0<br /> __dev_queue_xmit+0x208/0xba0<br /> ? nf_hook_slow+0x3f/0xd0<br /> ip_finish_output2+0x1ca/0x580<br /> ip_sublist_rcv_finish+0x32/0x40<br /> ip_sublist_rcv+0x1b2/0x1f0<br /> ? ip_rcv_finish_core.constprop.0+0x460/0x460<br /> ip_list_rcv+0x103/0x130<br /> __netif_receive_skb_list_core+0x181/0x1e0<br /> netif_receive_skb_list_internal+0x1b3/0x2c0<br /> napi_gro_receive+0xc8/0x200<br /> gro_cell_poll+0x52/0x90<br /> __napi_poll+0x25/0x1a0<br /> net_rx_action+0x28e/0x300<br /> __do_softirq+0xc3/0x276<br /> ? sort_range+0x20/0x20<br /> run_ksoftirqd+0x1e/0x30<br /> smpboot_thread_fn+0xa6/0x130<br /> kthread+0xcd/0x100<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ret_from_fork+0x31/0x50<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ret_from_fork_asm+0x11/0x20<br /> <br /> <br /> The suggested fix is to introduce a new wrapper (skb_page_unref) that<br /> covers page refcounting for page_pool pages as well.