Description
In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e8de370188d098bb49483c287b44925957c3c9b6 to < 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6aaffectede8de370188d098bb49483c287b44925957c3c9b6 to < fc79c07cdcde02c5b17633d78777de6ac2c14b29affectede8de370188d098bb49483c287b44925957c3c9b6 to < 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6affectede8de370188d098bb49483c287b44925957c3c9b6 to < bd8881c24a9520f9c3d3e855d866197f63e471a7affectede8de370188d098bb49483c287b44925957c3c9b6 to < 9a9929ec875ff20922c90c96fd544ae8a2a61a8daffectede8de370188d098bb49483c287b44925957c3c9b6 to < e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0affectede8de370188d098bb49483c287b44925957c3c9b6 to < 211c68d817a3d9dc14c0026a59da7cac30f8147eaffectede8de370188d098bb49483c287b44925957c3c9b6 to < 5cbef379a94b161726c5f504598bf4791d45cedcaffected
Linux Linux
Default version status: affected
4.6affected0 to < 4.6unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a ↗
- https://git.kernel.org/stable/c/fc79c07cdcde02c5b17633d78777de6ac2c14b29 ↗
- https://git.kernel.org/stable/c/26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6 ↗
- https://git.kernel.org/stable/c/bd8881c24a9520f9c3d3e855d866197f63e471a7 ↗
- https://git.kernel.org/stable/c/9a9929ec875ff20922c90c96fd544ae8a2a61a8d ↗
- https://git.kernel.org/stable/c/e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0 ↗
- https://git.kernel.org/stable/c/211c68d817a3d9dc14c0026a59da7cac30f8147e ↗
- https://git.kernel.org/stable/c/5cbef379a94b161726c5f504598bf4791d45cedc ↗