Description
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() __tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path. Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to < ea2edb27ef2648d8687cd0fc3ec3ba1793436e7eaffected918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to < 268cbe3a36ae57a2ec09601f343b92f6f092d505affected918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to < 86197679b293f0601c3331d545f99a70a7780aa9affected918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to < d4d05f55e9da646ec03adfa77260eb46f4163749affected
Linux Linux
Default version status: affected
6.12affected0 to < 6.12unaffected6.12.114 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected