Description
In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix race condition in netpoll_owner_active KCSAN detected a race condition in netpoll: BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb write (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10: net_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822) <snip> read to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2: netpoll_send_skb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393) netpoll_send_udp (net/core/netpoll.c:?) <snip> value changed: 0x0000000a -> 0xffffffff This happens because netpoll_owner_active() needs to check if the current CPU is the owner of the lock, touching napi->poll_owner non atomically. The ->poll_owner field contains the current CPU holding the lock. Use an atomic read to check if the poll owner is the current CPU.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
89c4b442b78bdba388337cc746fe63caba85f46c to < 43c0ca793a18578a0f5b305dd77fcf7ed99f1265affected89c4b442b78bdba388337cc746fe63caba85f46c to < efd29cd9c7b8369dfc7bcb34637e6bf1a188aa8eaffected89c4b442b78bdba388337cc746fe63caba85f46c to < 96826b16ef9c6568d31a1f6ceaa266411a46e46caffected89c4b442b78bdba388337cc746fe63caba85f46c to < 3f1a155950a1685ffd0fd7175b3f671da8771f3daffected89c4b442b78bdba388337cc746fe63caba85f46c to < a130e7da73ae93afdb4659842267eec734ffbd57affected89c4b442b78bdba388337cc746fe63caba85f46c to < c2e6a872bde9912f1a7579639c5ca3adf1003916affected
Linux Linux
Default version status: affected
4.10affected0 to < 4.10unaffected5.10.221 to ≤ 5.10.*unaffected5.15.162 to ≤ 5.15.*unaffected6.1.96 to ≤ 6.1.*unaffected6.6.36 to ≤ 6.6.*unaffected6.9.7 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/43c0ca793a18578a0f5b305dd77fcf7ed99f1265 ↗
- https://git.kernel.org/stable/c/efd29cd9c7b8369dfc7bcb34637e6bf1a188aa8e ↗
- https://git.kernel.org/stable/c/96826b16ef9c6568d31a1f6ceaa266411a46e46c ↗
- https://git.kernel.org/stable/c/3f1a155950a1685ffd0fd7175b3f671da8771f3d ↗
- https://git.kernel.org/stable/c/a130e7da73ae93afdb4659842267eec734ffbd57 ↗
- https://git.kernel.org/stable/c/c2e6a872bde9912f1a7579639c5ca3adf1003916 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html ↗