linux-cve-announce - CVE-2025-21883: ice: Fix deinitializing VF in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025032712-CVE-2025-21883-8b73@gregkh>
Date: Thu, 27 Mar 2025 15:58:17 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21883: ice: Fix deinitializing VF in error path

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix deinitializing VF in error path

If ice_ena_vfs() fails after calling ice_create_vf_entries(), it frees
all VFs without removing them from snapshot PF-VF mailbox list, leading
to list corruption.

Reproducer:
  devlink dev eswitch set $PF1_PCI mode switchdev
  ip l s $PF1 up
  ip l s $PF1 promisc on
  sleep 1
  echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
  sleep 1
  echo 1 > /sys/class/net/$PF1/device/sriov_numvfs

Trace (minimized):
  list_add corruption. next->prev should be prev (ffff8882e241c6f0), but was 0000000000000000. (next=ffff888455da1330).
  kernel BUG at lib/list_debug.c:29!
  RIP: 0010:__list_add_valid_or_report+0xa6/0x100
   ice_mbx_init_vf_info+0xa7/0x180 [ice]
   ice_initialize_vf_entry+0x1fa/0x250 [ice]
   ice_sriov_configure+0x8d7/0x1520 [ice]
   ? __percpu_ref_switch_mode+0x1b1/0x5d0
   ? __pfx_ice_sriov_configure+0x10/0x10 [ice]

Sometimes a KASAN report can be seen instead with a similar stack trace:
  BUG: KASAN: use-after-free in __list_add_valid_or_report+0xf1/0x100

VFs are added to this list in ice_mbx_init_vf_info(), but only removed
in ice_free_vfs(). Move the removing to ice_free_vf_entries(), which is
also being called in other places where VFs are being removed (including
ice_free_vfs() itself).

The Linux kernel CVE team has assigned CVE-2025-21883 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit 8cd8a6b17d275a45e3722d0215f6115b687c8c3e and fixed in 6.6.81 with commit 3c01102bec9592928e6b155da41cfcd5d25a2066
	Issue introduced in 6.4 with commit 8cd8a6b17d275a45e3722d0215f6115b687c8c3e and fixed in 6.12.18 with commit a4880583f88deba63504ce1c8287a70d39c01378
	Issue introduced in 6.4 with commit 8cd8a6b17d275a45e3722d0215f6115b687c8c3e and fixed in 6.13.6 with commit 34393fd78d7183a007eaf0090966ebedcc29bd57
	Issue introduced in 6.4 with commit 8cd8a6b17d275a45e3722d0215f6115b687c8c3e and fixed in 6.14 with commit 79990cf5e7aded76d0c092c9f5ed31eb1c75e02c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21883
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/intel/ice/ice_sriov.c
	drivers/net/ethernet/intel/ice/ice_vf_lib.c
	drivers/net/ethernet/intel/ice/ice_vf_lib_private.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3c01102bec9592928e6b155da41cfcd5d25a2066
	https://git.kernel.org/stable/c/a4880583f88deba63504ce1c8287a70d39c01378
	https://git.kernel.org/stable/c/34393fd78d7183a007eaf0090966ebedcc29bd57
	https://git.kernel.org/stable/c/79990cf5e7aded76d0c092c9f5ed31eb1c75e02c