CVE-2021-47139

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: put off calling register_netdev() until client initialize complete

Currently, the netdevice is registered before client initializing

complete. So there is a timewindow between netdevice available

and usable. In this case, if user try to change the channel number

or ring param, it may cause the hns3_set_rx_cpu_rmap() being called

twice, and report bug.

[47199.416502] hns3 0000:35:00.0 eth1: set channels: tqp_num=1, rxfh=0

[47199.430340] hns3 0000:35:00.0 eth1: already uninitialized

[47199.438554] hns3 0000:35:00.0: rss changes from 4 to 1

[47199.511854] hns3 0000:35:00.0: Channels changed, rss_size from 4 to 1, tqps from 4 to 1

[47200.163524] ------------[ cut here ]------------

[47200.171674] kernel BUG at lib/cpu_rmap.c:142!

[47200.177847] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP

[47200.185259] Modules linked in: hclge(+) hns3(-) hns3_cae(O) hns_roce_hw_v2 hnae3 vfio_iommu_type1 vfio_pci vfio_virqf

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References