Description
In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxl_pci_init_one() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxl_pci_remove_one(), including failure to allocate the coherent status area or to restore the DMA mask. wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and wanxl_reset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer. Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxl_pci_remove_one() already checks whether later resources were allocated. This issue was found by a static analysis checker and confirmed by manual source review.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3d9617d856ebddcdddbab0ce877c397420f59f55affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 897e289db1e4d00ca6419cfe733c646492147270affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f4834132773f15ffb255127499c8443947fa7d0faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b9e2ff70e96acf83693b27987e0390bad9f83efaaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 59cbe6cfa0fa23c192351cc284e30707309f6741affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2fe22d58b3797d741570f9873b26653fd511576caffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 91957b89da995607cb654b1f9a3c126ddbaee10faffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523 ↗
- https://git.kernel.org/stable/c/3d9617d856ebddcdddbab0ce877c397420f59f55 ↗
- https://git.kernel.org/stable/c/897e289db1e4d00ca6419cfe733c646492147270 ↗
- https://git.kernel.org/stable/c/f4834132773f15ffb255127499c8443947fa7d0f ↗
- https://git.kernel.org/stable/c/b9e2ff70e96acf83693b27987e0390bad9f83efa ↗
- https://git.kernel.org/stable/c/59cbe6cfa0fa23c192351cc284e30707309f6741 ↗
- https://git.kernel.org/stable/c/2fe22d58b3797d741570f9873b26653fd511576c ↗
- https://git.kernel.org/stable/c/91957b89da995607cb654b1f9a3c126ddbaee10f ↗