dma: fix call order in dmam_free_coherent
In the Linux kernel, the following vulnerability has been resolved: dma: fix call order in dmam_free_coherent dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list. If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by destroying the devres entry before freeing the DMA allocation. kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03
CVE-2024-43856
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-43856
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759",
"lessThan": "fe2d246080f035e0af5793cb79067ba125e4fb63",
"versionType": "git"
},
{
"status": "affected",
"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759",
"lessThan": "2f7bbdc744f2e7051d1cb47c8e082162df1923c9",
"versionType": "git"
},
{
"status": "affected",
"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759",
"lessThan": "257193083e8f43907e99ea633820fc2b3bcd24c7",
"versionType": "git"
},
{
"status": "affected",
"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759",
"lessThan": "87b34c8c94e29fa01d744e5147697f592998d954",
"versionType": "git"
},
{
"status": "affected",
"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759",
"lessThan": "f993a4baf6b622232e4c190d34c220179e5d61eb",
"versionType": "git"
},
{
"status": "affected",
"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759",
"lessThan": "1fe97f68fce1ba24bf823bfb0eb0956003473130",
"versionType": "git"
},
{
"status": "affected",
"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759",
"lessThan": "22094f5f52e7bc16c5bf9613365049383650b02e",
"versionType": "git"
},
{
"status": "affected",
"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759",
"lessThan": "28e8b7406d3a1f5329a03aa25a43aa28e087cb20",
"versionType": "git"
}
],
"programFiles": [
"kernel/dma/mapping.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.21",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.320",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.282",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.224",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.165",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.103",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.44",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.10.3",
"versionType": "semver",
"lessThanOrEqual": "6.10.*"
},
{
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/dma/mapping.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-43856
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26691 · Revision 1
- Added to Heist Feed
- Publisher date