Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to < da7e4a1aaf397af6a094f640c92d6bc7564c10dbaffectedca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to < 95e414f8324385771bdfd6d497a01d5593813ccbaffectedca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to < 26a96fa81496afe7d162d172ccdc8cb9dbc685d2affectedca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to < da87896f34e0a51489811d1a684e2953099ca98faffectedca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to < 0a9c520fdcb1cb2e79c163c12d359b5e1ee40007affectedca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to < 17bfe0a8c014ee1d542ad352cd6a0a505361664aaffected
Linux Linux
Default version status: affected
5.13affected0 to < 5.13unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/da7e4a1aaf397af6a094f640c92d6bc7564c10db ↗
- https://git.kernel.org/stable/c/95e414f8324385771bdfd6d497a01d5593813ccb ↗
- https://git.kernel.org/stable/c/26a96fa81496afe7d162d172ccdc8cb9dbc685d2 ↗
- https://git.kernel.org/stable/c/da87896f34e0a51489811d1a684e2953099ca98f ↗
- https://git.kernel.org/stable/c/0a9c520fdcb1cb2e79c163c12d359b5e1ee40007 ↗
- https://git.kernel.org/stable/c/17bfe0a8c014ee1d542ad352cd6a0a505361664a ↗