Description
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
23020f04932701d5c8363e60756f12b43b8ed752 to < dba5f4959653e4c212beb746594952e8645d1115affected23020f04932701d5c8363e60756f12b43b8ed752 to < f670fa4b19ceddc6d215dda4997888ccba9bbc61affected23020f04932701d5c8363e60756f12b43b8ed752 to < d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3affected23020f04932701d5c8363e60756f12b43b8ed752 to < bde34e84edc8b5571fbde7e941e175a4293ee1ebaffected
Linux Linux
Default version status: affected
6.11affected0 to < 6.11unaffected6.12.114 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected