In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()<\/p>\n
rvu_mbox_init() is called separately for AF-PF mailboxes during probe
\nand for AF-VF mailboxes when SR-IOV is enabled. Each call used to
\nallocate a new ng_rvu object, leaking the first allocation when the
\npointer was overwritten on the second call.<\/p>\n
Sharing one ng_rvu across both paths exposed several teardown bugs:
\nthe error path freed all cn20k mailbox DMA and kfree()d ng_rvu even
\nwhen only the failing init type should be unwound, leaving live AF-PF
\nmailbox memory in use after an AF-VF init failure. mutex_init() was
\nalso re-run on the AF-VF path while AF-PF mailbox handlers could still
\nhold rvu->mbox_lock. Probe and SR-IOV failure paths did not release
\ncn20k mailbox DMA either, since cleanup only happened in rvu_remove().<\/p>\n
Allocate ng_rvu once with devm_kzalloc(), initialize mbox_lock in the
\nsame block, unwind only the mailbox memory for the failing init type,
\nand free cn20k mailbox DMA from the probe and pci_enable_sriov()
\nerror paths.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()<\/p>\n
rvu_mbox_init() is called separately for AF-PF mailboxes duri<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25488","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}