In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ice: add missing xa_destroy for sched_node_ids<\/p>\n
Commit 16dfa49406bc (“ice: Introduce new parameters in ice_sched_node”)
\nadded a sched_node_ids xarray to the port info structure, but never called
\nxa_destroy on it.<\/p>\n
Since xarrays can allocate internal memory, this can result in a memory
\nleak even if every element in the xarray has been removed.<\/p>\n
The xarray is currently embedded in the port_info structure. This appears
\nto have been done because its use is within functions that take the
\nport_info as a primary argument.<\/p>\n
However, this complicates managing the lifecycle of the field. The
\nport_info structure is allocated in ice_init_hw() using devm, and it is
\nnot released until the devm cleanup when the driver is unloaded.<\/p>\n
The ice_init_hw() function is called in many places, including devlink
\nreload, and possibly during DDP load after updating the Tx scheduler
\nlayout.<\/p>\n
Adding a call of xa_destroy to the ice_deinit_hw() causes Sashiko to raise
\nmultiple concerns due to potential ordering issues and possible ways that
\nport_info could be a dangling reference.<\/p>\n
To handle this, move the sched_node_ids out of port_info and into the hw
\nstructure. All users of the array already have a pointer to hw anyways, and
\nthere is only one sched_node_ids per adapter. While here, remove the overly
\nverbose comment explaining the nature of the sched_node_ids xarray.<\/p>\n
Add the missing xa_destroy to the cleanup path and to ice_deinit_hw(),
\nensuring that we properly release the xarray memory.<\/p>\n
This was caught by Sashiko during development of unrelated code.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ice: add missing xa_destroy for sched_node_ids<\/p>\n
Commit 16dfa49406bc (“ice: Introduce new parameters in ice_sched_node”)
\nadded a sch<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29135","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}