In the Linux kernel, the following vulnerability has been resolved:

skbuff: fix coalescing for page_pool fragment recycling

Fix a use-after-free when using page_pool with page fragments. We encountered this problem during normal RX in the hns3 driver:

(1) Initially we have three descriptors in the RX queue. The first one allocates PAGE1 through page_pool, and the other two allocate one half of PAGE2 each. Page references look like this:

RX_BD1 _______ PAGE1 RX_BD2 _______ PAGE2 RX_BD3 _________/

(2) Handle RX on the first descriptor. Allocate SKB1, eventually added to the receive queue by tcp_queue_rcv().

(3) Handle RX on the second descriptor. Allocate SKB2 and pass it to netif_receive_skb():

netif_receive_skb(SKB2) ip_rcv(SKB2) SKB3 = skb_clone(SKB2)

SKB2 and SKB3 share a reference to PAGE2 through skb_shinfo()->dataref. The other ref to PAGE2 is still held by RX_BD3:

SKB2 ---+- PAGE2 SKB3 __/ / RX_BD3 _________/

(3b) Now while handling TCP, coalesce SKB3 with SKB1:

tcp_v4_rcv(SKB3) tcp_try_coalesce(to=SKB1, from=SKB3) // succeeds kfree_skb_partial(SKB3) skb_release_data(SKB3) // drops one dataref

SKB1 _____ PAGE1 \____ SKB2 _____ PAGE2 / R…

In the Linux kernel, the following vulnerability has been resolved:

skbuff: fix coalescing for page_pool fragment recycling

Fix a use-after-free when using page_pool with page fragments. We encountered this problem during normal RX in the hns3 driver:

(1) Initially we have three descriptors in the RX queue. The first one allocates PAGE1 through page_pool, and the other two allocate one half of PAGE2 each. Page references look like this:

RX_BD1 _______ PAGE1 RX_BD2 _______ PAGE2 RX_BD3 _________/

(2) Handle RX on the first descriptor. Allocate SKB1, eventually added to the receive queue by tcp_queue_rcv().

(3) Handle RX on the second descriptor. Allocate SKB2 and pass it to netif_receive_skb():

netif_receive_skb(SKB2) ip_rcv(SKB2) SKB3 = skb_clone(SKB2)

SKB2 and SKB3 share a reference to PAGE2 through skb_shinfo()->dataref. The other ref to PAGE2 is still held by RX_BD3:

SKB2 ---+- PAGE2 SKB3 __/ / RX_BD3 _________/

(3b) Now while handling TCP, coalesce SKB3 with SKB1:

tcp_v4_rcv(SKB3) tcp_try_coalesce(to=SKB1, from=SKB3) // succeeds kfree_skb_partial(SKB3) skb_release_data(SKB3) // drops one dataref

SKB1 _____ PAGE1 \____ SKB2 _____ PAGE2 / R…

kernel: off-path attacker may inject data or terminate victim's TCP session kernel: use-after-free vulnerability in function sco_sock_sendmsg() kernel: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' kernel: veth: ensure skb entering GRO are not cloned. kernel: inet: fully convert sk->sk_rx_dst to RCU rules kernel: irqchip/gic-v3-its: Fix potential VPE leak on error kernel: nvme-rdma: destroy cm id before destroy qp to avoid use after free kernel: ptp: Fix possible memory leak in ptp_clock_register() kernel: ethtool: do not perform operations on net devices being unregistered kernel: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() kernel: net: nexthop: fix null pointer dereference when IPv6 is not enabled kernel: scsi: scsi_debug: Fix type in min_t to avoid stack OOB kernel: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU kernel: Revert "Revert "block, bfq: honor already-setup queue merges"" kernel: udmabuf: validate ubuf->pagecount kernel: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() kernel: smb2_ioctl_query_info NULL pointer dereference kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: race condition in snd_pcm_hw_free leading to use-after-free kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region ke…

Security update for the Linux Kernel

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 85 more

In the Linux kernel, the following vulnerability has been resolved: skbuff: fix coalescing for page_pool fragment recycling Fix a use-after-free when using page_pool with page fragments. We encountered this problem during normal RX in the hns3 driver: (1) Initially we have three descriptors in the RX queue. The first one allocates PAGE1 through page_pool, and the other two allocate one half of PAGE2 each. Page references look like this: RX_BD1 _______ PAGE1 RX_BD2 _______ PAGE2 RX_BD3 _________/ (2) Handle RX on the first descriptor. Allocate SKB1, eventually added to the receive queue by tcp_queue_rcv(). (3) Handle RX on the second descriptor. Allocate SKB2 and pass it to netif_receive_skb(): netif_receive_skb(SKB2) ip_rcv(SKB2) SKB3 = skb_clone(SKB2) SKB2 and SKB3 share a reference to PAGE2 through skb_shinfo()->dataref. The other ref to PAGE2 is still held by RX_BD3: SKB2 ---+- PAGE2 SKB3 __/ / RX_BD3 _________/ (3b) Now while handling TCP, coalesce SKB3 with SKB1: tcp_v4_rcv(SKB3) tcp_try_coalesce(to=SKB1, from=SKB3) // succeeds kfree_skb_partial(SKB3) skb_release_data(SKB3) // drops one dataref SKB1 _____ PAGE1 \____ SKB2 _____ PAGE2 / RX_BD3 ______…