CVE-2021-47127

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: track AF_XDP ZC enabled queues in bitmap

Commit c7a219048e45 ("ice: Remove xsk_buff_pool from VSI structure")

silently introduced a regression and broke the Tx side of AF_XDP in copy

mode. xsk_pool on ice_ring is set only based on the existence of the XDP

prog on the VSI which in turn picks ice_clean_tx_irq_zc to be executed.

That is not something that should happen for copy mode as it should use

the regular data path ice_clean_tx_irq.

This results in a following splat when xdpsock is run in txonly or l2fwd

scenarios in copy mode:

<snip>

[ 106.050195] BUG: kernel NULL pointer dereference, address: 0000000000000030

[ 106.057269] #PF: supervisor read access in kernel mode

[ 106.062493] #PF: error_code(0x0000) - not-present page

[ 106.067709] PGD 0 P4D 0

[ 106.070293] Oops: 0000 [#1] PREEMPT SMP NOPTI

[ 106.074721] CPU: 61 PID: 0 Comm: swapper/61 Not tainted 5.12.0-rc2+ #45

[ 106.081436] Hardware name: Int

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References