Linux kernel ice driver vulnerabilities

In the Linux kernel, a bug was fixed in the ice driver where using writel_relaxed() for Tx doorbell updates did not provide proper write ordering on arm64. This introduced a race where the NIC could start transmitting before the dql->num_queued update was visible, triggering BUG_ON in dql_completed() and a kernel crash.

A bug was fixed in the Linux kernel's ice driver that caused a crash (NULL pointer dereference) during the ethtool offline loopback test. The crash occurred because libeth was not initialized for the rx ring in loopback VSIs. The fix treats ICE_VSI_LB VSIs more like normal PF VSIs by giving them a dummy q_vector, allowing the napi struct to be passed to libeth_rx_fq_create().

In the Linux kernel, the ice driver (Intel E800 NIC) has a race condition during VSI rebuild. PTP periodic work is queued before the VSI rebuild completes, causing a NULL pointer dereference on vsi->rx_rings and a kernel oops.

In the Linux kernel, a bug was found in the ice driver (Intel NIC) where the txq IRQ is disabled only after flushing the hardware, rendering the flush ineffective. This allows NAPI to run while the xsk_pool pointer is still valid but the software ring of xdp_buff pointers has already been freed, causing a NULL pointer dereference and kernel panic.

In the Linux kernel, the ice driver (Intel network card) has a synchronization issue between XDP configuration and PF reset. Lack of a mutex protecting ice_xdp() and ice_vsi_rebuild() can lead to a race condition and a kernel crash (NULL pointer dereference). The vulnerability is fixed by adding the xdp_state_lock mutex and a VSI state flag.