Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails, out_free_sg passes req->p2p_dev to pci_p2pmem_free_sgl() before that assignment has taken place. Pass the local p2p_dev argument instead, so cleanup uses the same PCI device as the successful data allocation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c440cd080761b18a52cac20f2a42e5da1e3995af to < eb72e2eeff559eb1eb07b1d644ce2bc1a16c4a80affectedbcd9a0797d73eeff659582f23277e7ab6e5f18f3 to < 48c8b59429d09a7c3598de425acbc2d3f4e6647baffectedbcd9a0797d73eeff659582f23277e7ab6e5f18f3 to < e8f24ae4f45efe6861f801c6ebd2789c9016f1bcaffectedbcd9a0797d73eeff659582f23277e7ab6e5f18f3 to < 3c231142c4f4bb96836469eb276026ec55940093affectedbcd9a0797d73eeff659582f23277e7ab6e5f18f3 to < 32f21607911a1f69c8f0f93a6c28fe6f8490aa98affectedbcd9a0797d73eeff659582f23277e7ab6e5f18f3 to < ce79a6c5cc1b8054ec8d3eba16adda4a36113438affectedbcd9a0797d73eeff659582f23277e7ab6e5f18f3 to < 73bf0f9579633b531098a475e6e55c9316763aedaffectedbcd9a0797d73eeff659582f23277e7ab6e5f18f3 to < 4aa9c0f377a4de5e8fddce76b34ee4529639a1ffaffected8a452d62e7cea3c8a2676a3b89a9118755a1a271affected5.10.43 to < 5.10.273affected5.12.10 to < 5.13affected
Linux Linux
Default version status: affected
5.13affected0 to < 5.13unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.2.11 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/eb72e2eeff559eb1eb07b1d644ce2bc1a16c4a80 ↗
- https://git.kernel.org/stable/c/48c8b59429d09a7c3598de425acbc2d3f4e6647b ↗
- https://git.kernel.org/stable/c/e8f24ae4f45efe6861f801c6ebd2789c9016f1bc ↗
- https://git.kernel.org/stable/c/3c231142c4f4bb96836469eb276026ec55940093 ↗
- https://git.kernel.org/stable/c/32f21607911a1f69c8f0f93a6c28fe6f8490aa98 ↗
- https://git.kernel.org/stable/c/ce79a6c5cc1b8054ec8d3eba16adda4a36113438 ↗
- https://git.kernel.org/stable/c/73bf0f9579633b531098a475e6e55c9316763aed ↗
- https://git.kernel.org/stable/c/4aa9c0f377a4de5e8fddce76b34ee4529639a1ff ↗