CVE-2024-39502

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ionic: fix use after netif_napi_del()

When queues are started, netif_napi_add() and napi_enable() are called.

If there are 4 queues and only 3 queues are used for the current

configuration, only 3 queues' napi should be registered and enabled.

The ionic_qcq_enable() checks whether the .poll pointer is not NULL for

enabling only the using queue' napi. Unused queues' napi will not be

registered by netif_napi_add(), so the .poll pointer indicates NULL.

But it couldn't distinguish whether the napi was unregistered or not

because netif_napi_del() doesn't reset the .poll pointer to NULL.

So, ionic_qcq_enable() calls napi_enable() for the queue, which was

unregistered by netif_napi_del().

Reproducer:

ethtool -L <interface name> rx 1 tx 1 combined 0

ethtool -L <interface name> rx 0 tx 0 combined 1

ethtool -L <interface name> rx 0 tx 0 combined 4

Splat looks like:

kernel BUG at net/core/dev.c:6666!

Oops: invalid op

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References