Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that a refcount is obtained at xdp_convert_md_to_buff() from bpf_prog_test_run_xdp(). According to commit ec94670fcb3b ("bpf: Support specifying ingress via xdp_md context in BPF_PROG_TEST_RUN"), the refcount obtained by xdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md(). Therefore, we can consider that the error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") forgot to call xdp_convert_buff_to_md().
Product status
1c194998252469cad00a08bd9ef0b99fd255c260 (git) before 368569bc546d3368ee9980ba79fc42fdff9a3365
1c194998252469cad00a08bd9ef0b99fd255c260 (git) before 98676ee71fd4eafeb8be63c7f3f1905d40e03101
1c194998252469cad00a08bd9ef0b99fd255c260 (git) before fb9ef40cccdbacce36029b305d0ef1e12e4fea38
1c194998252469cad00a08bd9ef0b99fd255c260 (git) before 737be05a765761d7d7c9f7fe92274bd8e6f6951e
1c194998252469cad00a08bd9ef0b99fd255c260 (git) before ec69daabe45256f98ac86c651b8ad1b2574489a7
5.18
Any version before 5.18
6.1.161 (semver)
6.6.121 (semver)
6.12.66 (semver)
6.18.6 (semver)
6.19-rc6 (original_commit_for_fix)
References
git.kernel.org/...c/368569bc546d3368ee9980ba79fc42fdff9a3365
git.kernel.org/...c/98676ee71fd4eafeb8be63c7f3f1905d40e03101
git.kernel.org/...c/fb9ef40cccdbacce36029b305d0ef1e12e4fea38
git.kernel.org/...c/737be05a765761d7d7c9f7fe92274bd8e6f6951e
git.kernel.org/...c/ec69daabe45256f98ac86c651b8ad1b2574489a7