CVE-2024-43834

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xdp: fix invalid wait context of page_pool_destroy()

If the driver uses a page pool, it creates a page pool with

page_pool_create().

The reference count of page pool is 1 as default.

A page pool will be destroyed only when a reference count reaches 0.

page_pool_destroy() is used to destroy page pool, it decreases a

reference count.

When a page pool is destroyed, ->disconnect() is called, which is

mem_allocator_disconnect().

This function internally acquires mutex_lock().

If the driver uses XDP, it registers a memory model with

xdp_rxq_info_reg_mem_model().

The xdp_rxq_info_reg_mem_model() internally increases a page pool

reference count if a memory model is a page pool.

Now the reference count is 2.

To destroy a page pool, the driver should call both page_pool_destroy()

and xdp_unreg_mem_model().

The xdp_unreg_mem_model() internally calls page_pool_destroy().

Only page_pool_destroy() decreases a reference count.

I

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References