In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommu\/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path<\/p>\n
tegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(), inits
\nit, and preallocates its logical VCMDQs. Two of its error paths leak.<\/p>\n
When tegra241_cmdqv_init_vintf() fails it returns before VINTF0 reaches the
\ncmdqv->vintfs[] array, so the devres unwind on probe failure cannot reach
\nit; free it directly there.<\/p>\n
A later VCMDQ preallocation failure instead leaves VINTF0 published, and so
\nthis time the unwind does reach tegra241_cmdqv_remove_vintf(), which then
\nfrees it from vintf->hyp_own. But tegra241_vintf_hw_init() sets that flag
\nonly afterward, from a HW read-back, so the still-uninited VINTF0 reads as
\nguest-owned and leaks, with mutex_destroy() and ida_destroy() run on fields
\nit never set up.<\/p>\n
Decide ownership from vintf->idx instead, the index assigned when its id is
\nallocated: idx 0 is the kernel-owned VINTF0, while idx >= 1 marks a guest
\nVINTF. So the in-kernel free decision in tegra241_cmdqv_remove_vintf() and
\ntegra241_vintf_free_lvcmdq() now keys on idx too, and hyp_own stays a pure
\nHW-readback state.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommu\/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path<\/p>\n
tegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25833","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}