Description
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in page_pool allocation The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). This is already checked in mvpp2_probe() during the initial activation of percpu_pools. However, mvpp2_change_mtu() may later call mvpp2_bm_switch_buffers(priv, true) without this check, which can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ entries, and mvpp2_get_nrxqs() may return exactly that value. The per-CPU scheme then doubles it to nrxqs * 2, exceeding the array bounds. Check that the hardware version is MVPP22 or newer and that the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS before switching to per-CPU mode. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7d04b0b13b1175ce0c4bdc77f1278c1f120f874f to < 5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3caffected7d04b0b13b1175ce0c4bdc77f1278c1f120f874f to < 4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545affected7d04b0b13b1175ce0c4bdc77f1278c1f120f874f to < dfd46b5584a5881b131008767950e1ab82713c8caffected7d04b0b13b1175ce0c4bdc77f1278c1f120f874f to < 6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0affected7d04b0b13b1175ce0c4bdc77f1278c1f120f874f to < e7f30dcfa6c64033bf9137362517bd248e5be384affected7d04b0b13b1175ce0c4bdc77f1278c1f120f874f to < f0e7d62c1eb984dd204095118973c59604144cd8affected7d04b0b13b1175ce0c4bdc77f1278c1f120f874f to < 1734c3fc0066e228ce1c11e434b7c2527f0a949aaffected7d04b0b13b1175ce0c4bdc77f1278c1f120f874f to < 14cb1e7702e5cb3c58888f6aed498381a73927d2affected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c ↗
- https://git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545 ↗
- https://git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c ↗
- https://git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0 ↗
- https://git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384 ↗
- https://git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8 ↗
- https://git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a ↗
- https://git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2 ↗