Description
In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x5f/0x70 [...] Call Trace: <TASK> __iommu_dma_free+0xe8/0x1c0 be_cmd_set_mac_list+0x3fe/0x640 [be2net] be_cmd_set_mac+0xaf/0x110 [be2net] be_vf_eth_addr_config+0x19f/0x330 [be2net] be_vf_setup+0x4f7/0x990 [be2net] be_pci_sriov_configure+0x3a1/0x470 [be2net] sriov_numvfs_store+0x20b/0x380 kernfs_fop_write_iter+0x354/0x530 vfs_write+0x9b9/0xf60 ksys_write+0xf3/0x1d0 do_syscall_64+0x8c/0x3d0 be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh. Fix it by freeing only after the lock has been released.
Product status
797bb9439c0489bbea4b8808297ec7a569098667 before 3697e37e012bbd2bb5a5b467689811ba097b2eff
7cfae8627511361f90a1a22dfae556c3fbc5bd8d before 975e73b9102d844a3dc3f091ad631c56145c8b4c
671aaa17bd3153e25526934f92307169ce927b5e before f80b34ebc579216407b128e9d155bfcae875c30f
4393452e6c0c027971ec9bcc9557f52e63db3f0a before 46d44a23a3723a89deeb65b13cddb17f8d9f2700
41d731e7920387ea13e2fb440a1e235686faeeb9 before c377ba2be9430d165a98e4b782902ed630bc7546
fd1ef3b1bdd3fec683ebd19eb3acc6a2cb60b5c6 before 0ddfe8b127ef1149fddccb79db6e6eaba7738e7d
1a82d19ca2d6835904ee71e2d40fd331098f94a0 before d5dc09ee5d74277bc47193fe28ce8703e229331b
1a82d19ca2d6835904ee71e2d40fd331098f94a0 before f4e4e0c4bc4d799d6fa39055acdbc3af066cd13e
1a82d19ca2d6835904ee71e2d40fd331098f94a0 before 5a40f8af2ba1b9bdf46e2db10e8c9710538fbc63
227a829c9067bf03b1967e7e0b1a6777fd57edef
6.14
Any version before 6.14
5.4.297
5.10.241
5.15.190
6.1.148
6.6.102
6.12.42
6.15.10
6.16.1
6.17
References
git.kernel.org/...c/3697e37e012bbd2bb5a5b467689811ba097b2eff
git.kernel.org/...c/975e73b9102d844a3dc3f091ad631c56145c8b4c
git.kernel.org/...c/f80b34ebc579216407b128e9d155bfcae875c30f
git.kernel.org/...c/46d44a23a3723a89deeb65b13cddb17f8d9f2700
git.kernel.org/...c/c377ba2be9430d165a98e4b782902ed630bc7546
git.kernel.org/...c/0ddfe8b127ef1149fddccb79db6e6eaba7738e7d
git.kernel.org/...c/d5dc09ee5d74277bc47193fe28ce8703e229331b
git.kernel.org/...c/f4e4e0c4bc4d799d6fa39055acdbc3af066cd13e
git.kernel.org/...c/5a40f8af2ba1b9bdf46e2db10e8c9710538fbc63
