CVE-2024-50042

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ice: Fix increasing MSI-X on VF<br /> <br /> Increasing MSI-X value on a VF leads to invalid memory operations. This<br /> is caused by not reallocating some arrays.<br /> <br /> Reproducer:<br /> modprobe ice<br /> echo 0 &gt; /sys/bus/pci/devices/$PF_PCI/sriov_drivers_autoprobe<br /> echo 1 &gt; /sys/bus/pci/devices/$PF_PCI/sriov_numvfs<br /> echo 17 &gt; /sys/bus/pci/devices/$VF0_PCI/sriov_vf_msix_count<br /> <br /> Default MSI-X is 16, so 17 and above triggers this issue.<br /> <br /> KASAN reports:<br /> <br /> BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]<br /> Read of size 8 at addr ffff8888b937d180 by task bash/28433<br /> (...)<br /> <br /> Call Trace:<br /> (...)<br /> ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]<br /> kasan_report+0xed/0x120<br /> ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]<br /> ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]<br /> ice_vsi_cfg_def+0x3360/0x4770 [ice]<br /> ? mutex_unlock+0x83/0xd0<br /> ? __pfx_ice_vsi_cfg_def+0x10/0x10 [ice]<br /> ? __pfx_ice_remove_vsi_lkup_fltr+0x10/0x10 [ice]<br /> ice_vsi_cfg+0x7f/0x3b0 [ice]<br /> ice_vf_reconfig_vsi+0x114/0x210 [ice]<br /> ice_sriov_set_msix_vec_count+0x3d0/0x960 [ice]<br /> sriov_vf_msix_count_store+0x21c/0x300<br /> (...)<br /> <br /> Allocated by task 28201:<br /> (...)<br /> ice_vsi_cfg_def+0x1c8e/0x4770 [ice]<br /> ice_vsi_cfg+0x7f/0x3b0 [ice]<br /> ice_vsi_setup+0x179/0xa30 [ice]<br /> ice_sriov_configure+0xcaa/0x1520 [ice]<br /> sriov_numvfs_store+0x212/0x390<br /> (...)<br /> <br /> To fix it, use ice_vsi_rebuild() instead of ice_vf_reconfig_vsi(). This<br /> causes the required arrays to be reallocated taking the new queue count<br /> into account (ice_vsi_realloc_stat_arrays()). Set req_txq and req_rxq<br /> before ice_vsi_rebuild(), so that realloc uses the newly set queue<br /> count.<br /> <br /> Additionally, ice_vsi_rebuild() does not remove VSI filters<br /> (ice_fltr_remove_all()), so ice_vf_init_host_cfg() is no longer<br /> necessary.