CVE-2024-53092

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> virtio_pci: Fix admin vq cleanup by using correct info pointer<br /> <br /> vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq<br /> resources by virtio_pci_vq_info pointer. The info pointer of admin<br /> vq is stored in vp_dev-&gt;admin_vq.info instead of vp_dev-&gt;vqs[].<br /> Using the info pointer from vp_dev-&gt;vqs[] for admin vq causes a<br /> kernel NULL pointer dereference bug.<br /> In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer<br /> from vp_dev-&gt;admin_vq.info for admin vq to clean up the resources.<br /> Also make info ptr as argument of vp_del_vq() to be symmetric with<br /> vp_setup_vq().<br /> <br /> vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace:<br /> ==================================================================<br /> BUG: kernel NULL pointer dereference, address:0000000000000000<br /> ...<br /> CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1<br /> RIP: 0010:vp_reset+0x57/0x90 [virtio_pci]<br /> Call Trace:<br /> <br /> ...<br /> ? vp_reset+0x57/0x90 [virtio_pci]<br /> ? vp_reset+0x38/0x90 [virtio_pci]<br /> virtio_reset_device+0x1d/0x30<br /> remove_vq_common+0x1c/0x1a0 [virtio_net]<br /> virtnet_remove+0xa1/0xc0 [virtio_net]<br /> virtio_dev_remove+0x46/0xa0<br /> ...<br /> virtio_pci_driver_exit+0x14/0x810 [virtio_pci]<br /> ==================================================================