Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: Fix admin vq cleanup by using correct info pointer vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq resources by virtio_pci_vq_info pointer. The info pointer of admin vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[]. Using the info pointer from vp_dev->vqs[] for admin vq causes a kernel NULL pointer dereference bug. In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer from vp_dev->admin_vq.info for admin vq to clean up the resources. Also make info ptr as argument of vp_del_vq() to be symmetric with vp_setup_vq(). vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace: ================================================================== BUG: kernel NULL pointer dereference, address:0000000000000000 ... CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1 RIP: 0010:vp_reset+0x57/0x90 [virtio_pci] Call Trace: <TASK> ... ? vp_reset+0x57/0x90 [virtio_pci] ? vp_reset+0x38/0x90 [virtio_pci] virtio_reset_device+0x1d/0x30 remove_vq_common+0x1c/0x1a0 [virtio_net] virtnet_remove+0xa1/0xc0 [virtio_net] virtio_dev_remove+0x46/0xa0 ... virtio_pci_driver_exit+0x14/0x810 [virtio_pci] ==================================================================
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 4c3b54af907e709609d3d8beca92d65e2f0cfd83 before 018d3d4ad4be7fbc95d8a2367642a32d21df55c7; affected 4c3b54af907e709609d3d8beca92d65e2f0cfd83 before 97ee04feb682c906a1fa973ebe586fe91567d165 |
| Linux / Linux | affected 6.11; unaffected 0 before 6.11; unaffected 6.11.9 through 6.11.*; unaffected 6.12 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/018d3d4ad4be7fbc95d8a2367642a32d21df55c7
- https://git.kernel.org/stable/c/97ee04feb682c906a1fa973ebe586fe91567d165
ADP enrichment
No English description supplied.
No references supplied.