Description
In the Linux kernel, the following vulnerability has been resolved: virtio: packed: fix unmap leak for indirect desc table When use_dma_api and premapped are true, then the do_unmap is false. Because the do_unmap is false, vring_unmap_extra_packed is not called by detach_buf_packed. if (unlikely(vq->do_unmap)) { curr = id; for (i = 0; i < state->num; i++) { vring_unmap_extra_packed(vq, &vq->packed.desc_extra[curr]); curr = vq->packed.desc_extra[curr].next; } } So the indirect desc table is not unmapped. This causes the unmap leak. So here, we check vq->use_dma_api instead. Synchronously, dma info is updated based on use_dma_api judgment This bug does not occur, because no driver use the premapped with indirect.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b319940f83c21bb4c1fabffe68a862be879a6193 to < e142169aca5546ae6619c39a575cda8105362100affectedb319940f83c21bb4c1fabffe68a862be879a6193 to < 75450ff8c6fe8755bf5b139b238eaf9739cfd64eaffectedb319940f83c21bb4c1fabffe68a862be879a6193 to < 51bacd9d29bf98c3ebc65e4a0477bb86306b4140affectedb319940f83c21bb4c1fabffe68a862be879a6193 to < d5c0ed17fea60cca9bc3bf1278b49ba79242bbcdaffected
Linux Linux
Default version status: affected
6.6affected0 to < 6.6unaffected6.6.23 to ≤ 6.6.*unaffected6.7.11 to ≤ 6.7.*unaffected6.8.2 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected