Description
In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d43732ce021f4244a4c53a45d57ad0c13c30ed94 to < decb4d4ead2c71ef698727734ab5024a872eb372affectedd43732ce021f4244a4c53a45d57ad0c13c30ed94 to < c54bbdf6f0731102a4bf7f5e4ee535b3ea415996affectedd43732ce021f4244a4c53a45d57ad0c13c30ed94 to < a065bd31ec462f6f9c267026b708dd020f122723affectedd43732ce021f4244a4c53a45d57ad0c13c30ed94 to < d24fdec1413c656d29298097926e77542785ca0caffectedd43732ce021f4244a4c53a45d57ad0c13c30ed94 to < af0524bf4ce1a4cbd2946aa81751582951cfcab5affected
Linux Linux
Default version status: affected
4.13affected0 to < 4.13unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.2.11 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/decb4d4ead2c71ef698727734ab5024a872eb372 ↗
- https://git.kernel.org/stable/c/c54bbdf6f0731102a4bf7f5e4ee535b3ea415996 ↗
- https://git.kernel.org/stable/c/a065bd31ec462f6f9c267026b708dd020f122723 ↗
- https://git.kernel.org/stable/c/d24fdec1413c656d29298097926e77542785ca0c ↗
- https://git.kernel.org/stable/c/af0524bf4ce1a4cbd2946aa81751582951cfcab5 ↗