Description
In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in the queue which might run after the cvm_oct_remove() frees net_device structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it iterates cvm_oct_device[] which is an array of netdevice pointers. Add tasklet_kill() after free_irq() to ensure the tasklet is no longer scheduled or running before teardown proceeds.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
4898c560103fb8075c10a8e9d70e0ca26873075e to < 32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486affected4898c560103fb8075c10a8e9d70e0ca26873075e to < d15226338dfaa84ffff142d32723cdf74d0c47c4affected4898c560103fb8075c10a8e9d70e0ca26873075e to < a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19affected4898c560103fb8075c10a8e9d70e0ca26873075e to < b6365e4186322858a82c8713b1d0bd209c8e765aaffected4898c560103fb8075c10a8e9d70e0ca26873075e to < 03d12490afd1198310ad0aba42462329832eb739affected4898c560103fb8075c10a8e9d70e0ca26873075e to < 2c0c9956596e48654bb4855e2a0742748a0826a7affected4898c560103fb8075c10a8e9d70e0ca26873075e to < 41a79bd9e5a74f8f483b3b206d10567912874fb4affected4898c560103fb8075c10a8e9d70e0ca26873075e to < b9af44b0d20b2247c4eb0ea5cfca907d643eea50affected
Linux Linux
Default version status: affected
2.6.34affected0 to < 2.6.34unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486 ↗
- https://git.kernel.org/stable/c/d15226338dfaa84ffff142d32723cdf74d0c47c4 ↗
- https://git.kernel.org/stable/c/a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19 ↗
- https://git.kernel.org/stable/c/b6365e4186322858a82c8713b1d0bd209c8e765a ↗
- https://git.kernel.org/stable/c/03d12490afd1198310ad0aba42462329832eb739 ↗
- https://git.kernel.org/stable/c/2c0c9956596e48654bb4855e2a0742748a0826a7 ↗
- https://git.kernel.org/stable/c/41a79bd9e5a74f8f483b3b206d10567912874fb4 ↗
- https://git.kernel.org/stable/c/b9af44b0d20b2247c4eb0ea5cfca907d643eea50 ↗