Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 276bd7ed34d56c48c65c43c0b08f2ee77029b2fa; affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 before f9bcff265556796834122f95de16d52a8375206c; affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 17e01e342af74de12899c206dcc9ec90684703aa; affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 152fcb74a26804b70909381c6acc90595a0ae1c1; affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 6a917199aaf97904f5619afe3dfdacb155b03e8c; affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 32e3d364a7b8295120d37e6a6bd433d2de26f748; affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 4699b54fada156534cbb39834d47fc9374d7a1f5; affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 74186c2968f8f756ac3226b545b598457c910c75 |
| Linux / Linux | affected 5.3; unaffected 0 before 5.3; unaffected 5.10.267 through 5.10.*; unaffected 5.15.218 through 5.15.*; unaffected 6.1.185 through 6.1.*; unaffected 6.6.154 through 6.6.*; unaffected 6.12.105 through 6.12.*; unaffected 6.18.46 through 6.18.*; unaffected 7.1.10 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/276bd7ed34d56c48c65c43c0b08f2ee77029b2fa
- https://git.kernel.org/stable/c/f9bcff265556796834122f95de16d52a8375206c
- https://git.kernel.org/stable/c/17e01e342af74de12899c206dcc9ec90684703aa
- https://git.kernel.org/stable/c/152fcb74a26804b70909381c6acc90595a0ae1c1
- https://git.kernel.org/stable/c/6a917199aaf97904f5619afe3dfdacb155b03e8c
- https://git.kernel.org/stable/c/32e3d364a7b8295120d37e6a6bd433d2de26f748
- https://git.kernel.org/stable/c/4699b54fada156534cbb39834d47fc9374d7a1f5
- https://git.kernel.org/stable/c/74186c2968f8f756ac3226b545b598457c910c75