Description
In the Linux kernel, the following vulnerability has been resolved: nfp: Check resource mutex allocation nfp_cpp_resource_find() allocates a CPP mutex handle for the matching resource-table entry and then reports success. nfp_resource_try_acquire() immediately passes that handle to nfp_cpp_mutex_trylock(). However, nfp_cpp_mutex_alloc() returns NULL on failure. If that happens for a matching table entry, the resource lookup still returns success and the following trylock dereferences a NULL mutex pointer while opening the resource. nfp_resource_acquire() already treats failure to allocate the table mutex as -ENOMEM. Do the same for the resource mutex and fail the lookup before publishing the rest of the resource handle. This issue was found by a static analysis checker and confirmed by manual source review.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f01a2161577d31b14581e0db3bbbdfa963f145b6 to < 18737a48acc87e4cbe41d6fea9a3f44eae490e24affectedf01a2161577d31b14581e0db3bbbdfa963f145b6 to < 423523f96a681428ce6e214eaf47f0d8242319deaffectedf01a2161577d31b14581e0db3bbbdfa963f145b6 to < 0dbd85a8cc35c14bd26e686fa5fae8c64a7958aeaffectedf01a2161577d31b14581e0db3bbbdfa963f145b6 to < 6dbd428119cb1fd1b73cf6968c711f4ea964dc8baffectedf01a2161577d31b14581e0db3bbbdfa963f145b6 to < cfa119aa781c4044dab5b4c1e5864600f53a26bcaffectedf01a2161577d31b14581e0db3bbbdfa963f145b6 to < 3b1d4fc3b73ea6faf008a0996ce6190c6e43efc3affectedf01a2161577d31b14581e0db3bbbdfa963f145b6 to < a7dc30b6828c3a30252892827b12b676749f250faffectedf01a2161577d31b14581e0db3bbbdfa963f145b6 to < a61b4db34a753bdf5c9e77a7f3d3dddd41dcfaccaffected
Linux Linux
Default version status: affected
4.11affected0 to < 4.11unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/18737a48acc87e4cbe41d6fea9a3f44eae490e24 ↗
- https://git.kernel.org/stable/c/423523f96a681428ce6e214eaf47f0d8242319de ↗
- https://git.kernel.org/stable/c/0dbd85a8cc35c14bd26e686fa5fae8c64a7958ae ↗
- https://git.kernel.org/stable/c/6dbd428119cb1fd1b73cf6968c711f4ea964dc8b ↗
- https://git.kernel.org/stable/c/cfa119aa781c4044dab5b4c1e5864600f53a26bc ↗
- https://git.kernel.org/stable/c/3b1d4fc3b73ea6faf008a0996ce6190c6e43efc3 ↗
- https://git.kernel.org/stable/c/a7dc30b6828c3a30252892827b12b676749f250f ↗
- https://git.kernel.org/stable/c/a61b4db34a753bdf5c9e77a7f3d3dddd41dcfacc ↗