Description
In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs. Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fcc680a647ba77370480fe753664cc10d572b240 to < f78d45d5f1ac4141a03f033141368671da4293e4affectedfcc680a647ba77370480fe753664cc10d572b240 to < 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849caffectedfcc680a647ba77370480fe753664cc10d572b240 to < bdea4980182e3badac74f04df6c07492b91c569eaffected
Linux Linux
Default version status: affected
6.14affected0 to < 6.14unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected