In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-pci: fix use-after-free in nvme_free_host_mem()<\/p>\n
nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()
\nbut never clears the pointer afterward. This leads to a use-after-free
\nif nvme_free_host_mem() is called twice in the same error path.<\/p>\n
This can happen during nvme_probe() when nvme_setup_host_mem() succeeds
\nin allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem()
\nfails with an I\/O error:<\/p>\n
nvme_setup_host_mem()
\n nvme_alloc_host_mem_single() -> sets dev->hmb_sgt
\n nvme_set_host_mem() -> fails with -EIO
\n nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it
\n return error<\/p>\n
nvme_probe() error path:
\n nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free<\/p>\n
The second call dereferences the freed sgt, causing a NULL pointer
\ndereference in iommu_dma_free_noncontiguous() when it accesses
\nsgt->sgl->dma_address (the backing memory has been freed and zeroed).<\/p>\n
This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC
\nEnvoy Express behind a Dell WD22TB4 dock) where the device intermittently
\nreturns I\/O errors during HMB setup due to PCIe link instability.<\/p>\n
BUG: kernel NULL pointer dereference, address: 0000000000000010
\n RIP: 0010:iommu_dma_free_noncontiguous+0x22\/0x80
\n Call Trace:<\/p>\n
dma_free_noncontiguous+0x3b\/0x130
\n nvme_free_host_mem+0x30\/0xf0 [nvme]
\n nvme_probe.cold+0xcc\/0x275 [nvme]
\n local_pci_probe+0x43\/0xa0
\n pci_device_probe+0xeea\/0x290
\n really_probe+0xf9\/0x3b0
\n __driver_probe_device+0x8b\/0x170
\n driver_probe_device+0x24\/0xd0
\n __driver_attach_async_helper+0x6b\/0x110
\n async_run_entry_fn+0x37\/0x170
\n process_one_work+0x1ac\/0x3d0
\n worker_thread+0x1b8\/0x360
\n kthread+0xf7\/0x130
\n ret_from_fork+0x2d8\/0x3a0
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Fix this by setting dev->hmb_sgt to NULL after freeing it, so the
\nsecond call takes the multi-descriptor path which safely handles the
\nalready-cleaned-up state.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-pci: fix use-after-free in nvme_free_host_mem()<\/p>\n
nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()
\nbut neve<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15052","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}