Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected ec5d31e3c15d5233b491400133c67f78a320062c before dc797a4bbbcac6d19e6e2508e4df685755cd94a5; affected ec5d31e3c15d5233b491400133c67f78a320062c before d00e98977ef519280b075d783653e2c492fffbb6; affected ec5d31e3c15d5233b491400133c67f78a320062c before 9ab6a9950f152e094395d2e3967f889857daa185; affected ec5d31e3c15d5233b491400133c67f78a320062c before 2747328ba2714f1a7454208dbbc1dc0631990b4a |
| Linux / Linux | affected 5.4; unaffected 0 before 5.4; unaffected 6.6.160 through 6.6.*; unaffected 6.12.45 through 6.12.*; unaffected 6.16.5 through 6.16.*; unaffected 6.17 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/dc797a4bbbcac6d19e6e2508e4df685755cd94a5
- https://git.kernel.org/stable/c/d00e98977ef519280b075d783653e2c492fffbb6
- https://git.kernel.org/stable/c/9ab6a9950f152e094395d2e3967f889857daa185
- https://git.kernel.org/stable/c/2747328ba2714f1a7454208dbbc1dc0631990b4a
ADP enrichment
No English description supplied.
No references supplied.