In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()<\/p>\n
bnxt_rx_ring_reset() frees the ring buffers and then reallocates them,
\nignoring the result.<\/p>\n
bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which
\nreturns -ENOMEM on the first failed allocation and leaves the remaining
\nrxr->rx_tpa[] entries zeroed.<\/p>\n
The error isn’t propagated up, so the loop in bnxt_rx_ring_reset
\ncontinues and at the end the code re-enables TPA with partially
\nunallocated rx_tpa array.<\/p>\n
This means that when the agg_id from hardware is mapped to a SW index in
\nrxr->rx_tpa[], an uninitialized slot can be chosen which would hand a
\nzero DMA address to the device.<\/p>\n
Fix this by falling back to a global reset, which is what the existing
\ncode already does when other functions fail, but unlike the other
\nfailure cases this particular failure has to return because TPA can’t
\nbe re-enabled since the allocation failed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()<\/p>\n
bnxt_rx_ring_reset() frees the ring buffers and then reallocates<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29005","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}