In the Linux kernel, the following vulnerability has been resolved:
netpoll: Fix race condition in netpollowneractive
KCSAN detected a race condition in netpoll:
BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb
write (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10:
net_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822)
<snip> read to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2: netpollsendskb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393) netpollsendudp (net/core/netpoll.c:?) <snip> value changed: 0x0000000a -> 0xffffffff
This happens because netpollowneractive() needs to check if the current CPU is the owner of the lock, touching napi->pollowner non atomically. The ->pollowner field contains the current CPU holding the lock.
Use an atomic read to check if the poll owner is the current CPU.
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"286656155520135469916133143417463055212",
"168606510864381571652114959636456378891",
"142434762405738057323153607374190091638",
"252925901924990896370949725947621465215"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96826b16ef9c6568d31a1f6ceaa266411a46e46c",
"target": {
"file": "net/core/netpoll.c"
},
"id": "CVE-2024-41005-1cb6df2b"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"286656155520135469916133143417463055212",
"168606510864381571652114959636456378891",
"142434762405738057323153607374190091638",
"252925901924990896370949725947621465215"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f1a155950a1685ffd0fd7175b3f671da8771f3d",
"target": {
"file": "net/core/netpoll.c"
},
"id": "CVE-2024-41005-2ac9c69d"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "310107055096881541524090139875965370911"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2e6a872bde9912f1a7579639c5ca3adf1003916",
"target": {
"file": "net/core/netpoll.c",
"function": "netpoll_owner_active"
},
"id": "CVE-2024-41005-2d130094"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"286656155520135469916133143417463055212",
"168606510864381571652114959636456378891",
"142434762405738057323153607374190091638",
"252925901924990896370949725947621465215"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efd29cd9c7b8369dfc7bcb34637e6bf1a188aa8e",
"target": {
"file": "net/core/netpoll.c"
},
"id": "CVE-2024-41005-34dab64d"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"286656155520135469916133143417463055212",
"168606510864381571652114959636456378891",
"142434762405738057323153607374190091638",
"252925901924990896370949725947621465215"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43c0ca793a18578a0f5b305dd77fcf7ed99f1265",
"target": {
"file": "net/core/netpoll.c"
},
"id": "CVE-2024-41005-47dc00f9"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"286656155520135469916133143417463055212",
"168606510864381571652114959636456378891",
"142434762405738057323153607374190091638",
"252925901924990896370949725947621465215"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2e6a872bde9912f1a7579639c5ca3adf1003916",
"target": {
"file": "net/core/netpoll.c"
},
"id": "CVE-2024-41005-7bb28a06"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "310107055096881541524090139875965370911"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efd29cd9c7b8369dfc7bcb34637e6bf1a188aa8e",
"target": {
"file": "net/core/netpoll.c",
"function": "netpoll_owner_active"
},
"id": "CVE-2024-41005-7ea88b18"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "310107055096881541524090139875965370911"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f1a155950a1685ffd0fd7175b3f671da8771f3d",
"target": {
"file": "net/core/netpoll.c",
"function": "netpoll_owner_active"
},
"id": "CVE-2024-41005-8ad9d8ce"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "310107055096881541524090139875965370911"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43c0ca793a18578a0f5b305dd77fcf7ed99f1265",
"target": {
"file": "net/core/netpoll.c",
"function": "netpoll_owner_active"
},
"id": "CVE-2024-41005-d03fd9d3"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "310107055096881541524090139875965370911"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96826b16ef9c6568d31a1f6ceaa266411a46e46c",
"target": {
"file": "net/core/netpoll.c",
"function": "netpoll_owner_active"
},
"id": "CVE-2024-41005-d8e32704"
}
]