bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.112, 6.18.53, 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rx_tpa[] entries zeroed. bnxt_queue_mem_alloc() discards that return value, so the partially initialized ring is installed by bnxt_queue_start(). Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by checking the return value of bnxt_alloc_one_tpa_info_data and unwinding, freeing the ring buffers.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 0997443906b96a051011f220a61e6dce4602ec54 · fixed in d7db2e4953e4626339fd0075564a3e447650d37b; From bd649c5cc958169b8a8a3e77ea926d92d472b02a · fixed in c8050386a2209b2a474c1eb4bd1574dc19129bfb; From bd649c5cc958169b8a8a3e77ea926d92d472b02a · fixed in 37e08dc821a57fe0592c917486b638caa888b46d; From bd649c5cc958169b8a8a3e77ea926d92d472b02a · fixed in b814dfbfeb0a68c9a52073f2caa05a2d5247a329; From 6.12.20 · fixed in 6.12.112
- Linux Linux
6.13
- KernelLinux
fixed in 6.12.112; From 6.13.0 · fixed in 6.18.53; fixed in 7.2.7