Bug 2327171 (CVE-2024-50297) - CVE-2024-50297 kernel: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts
Summary: CVE-2024-50297 kernel: net: xilinx: axienet: Enqueue Tx packets in dql before...
Keywords:
Status: NEW
Alias: CVE-2024-50297
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2327248
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-11-19 02:01 UTC by OSIDB Bzimport
Modified: 2024-11-21 19:02 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-11-19 02:01:33 UTC
In the Linux kernel, the following vulnerability has been resolved:

net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts

Enqueue packets in dql after dma engine starts causes race condition.
Tx transfer starts once dma engine is started and may execute dql dequeue
in completion before it gets queued. It results in following kernel crash
while running iperf stress test:

kernel BUG at lib/dynamic_queue_limits.c:99!
<snip>
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
pc : dql_completed+0x238/0x248
lr : dql_completed+0x3c/0x248

Call trace:
  dql_completed+0x238/0x248
  axienet_dma_tx_cb+0xa0/0x170
  xilinx_dma_do_tasklet+0xdc/0x290
  tasklet_action_common+0xf8/0x11c
  tasklet_action+0x30/0x3c
  handle_softirqs+0xf8/0x230
<snip>

Start dmaengine after enqueue in dql fixes the crash.

Comment 1 Avinash Hanwate 2024-11-19 05:59:42 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024111902-CVE-2024-50297-7693@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.