| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-53134: bnxt_en: Avoid order-5 memory allocation for TPA data |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| bnxt_en: Avoid order-5 memory allocation for TPA data |
| |
| The driver needs to keep track of all the possible concurrent TPA (GRO/LRO) |
| completions on the aggregation ring. On P5 chips, the maximum number |
| of concurrent TPA is 256 and the amount of memory we allocate is order-5 |
| on systems using 4K pages. Memory allocation failure has been reported: |
| |
| NetworkManager: page allocation failure: order:5, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 |
| CPU: 15 PID: 2995 Comm: NetworkManager Kdump: loaded Not tainted 5.10.156 #1 |
| Hardware name: Dell Inc. PowerEdge R660/0M1CC5, BIOS 0.2.25 08/12/2022 |
| Call Trace: |
| dump_stack+0x57/0x6e |
| warn_alloc.cold.120+0x7b/0xdd |
| ? _cond_resched+0x15/0x30 |
| ? __alloc_pages_direct_compact+0x15f/0x170 |
| __alloc_pages_slowpath.constprop.108+0xc58/0xc70 |
| __alloc_pages_nodemask+0x2d0/0x300 |
| kmalloc_order+0x24/0xe0 |
| kmalloc_order_trace+0x19/0x80 |
| bnxt_alloc_mem+0x1150/0x15c0 [bnxt_en] |
| ? bnxt_get_func_stat_ctxs+0x13/0x60 [bnxt_en] |
| __bnxt_open_nic+0x12e/0x780 [bnxt_en] |
| bnxt_open+0x10b/0x240 [bnxt_en] |
| __dev_open+0xe9/0x180 |
| __dev_change_flags+0x1af/0x220 |
| dev_change_flags+0x21/0x60 |
| do_setlink+0x35c/0x1100 |
| |
| Instead of allocating this big chunk of memory and dividing it up for the |
| concurrent TPA instances, allocate each small chunk separately for each |
| TPA instance. This will reduce it to order-0 allocations. |
| |
| The Linux kernel CVE team has assigned CVE-2023-53134 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.4 with commit 79632e9ba38671215fb193346ef6fb8db582744d and fixed in 5.4.237 with commit 16f3aae1aa2dd89bc8d073a67f190af580386ae9 |
| Issue introduced in 5.4 with commit 79632e9ba38671215fb193346ef6fb8db582744d and fixed in 5.10.175 with commit d16701a385b54f44bf41ff1d7485e7a11080deb3 |
| Issue introduced in 5.4 with commit 79632e9ba38671215fb193346ef6fb8db582744d and fixed in 5.15.103 with commit 20fd0607acbf9770db9b99e3418dd75614f80b6c |
| Issue introduced in 5.4 with commit 79632e9ba38671215fb193346ef6fb8db582744d and fixed in 6.1.20 with commit fcae40e65802547def39b4deaa2ae38a29864d81 |
| Issue introduced in 5.4 with commit 79632e9ba38671215fb193346ef6fb8db582744d and fixed in 6.2.7 with commit ad529d1fae1565d38f929479d4ea8aea90054bd2 |
| Issue introduced in 5.4 with commit 79632e9ba38671215fb193346ef6fb8db582744d and fixed in 6.3 with commit accd7e23693aaaa9aa0d3e9eca0ae77d1be80ab3 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-53134 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/broadcom/bnxt/bnxt.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/16f3aae1aa2dd89bc8d073a67f190af580386ae9 |
| https://git.kernel.org/stable/c/d16701a385b54f44bf41ff1d7485e7a11080deb3 |
| https://git.kernel.org/stable/c/20fd0607acbf9770db9b99e3418dd75614f80b6c |
| https://git.kernel.org/stable/c/fcae40e65802547def39b4deaa2ae38a29864d81 |
| https://git.kernel.org/stable/c/ad529d1fae1565d38f929479d4ea8aea90054bd2 |
| https://git.kernel.org/stable/c/accd7e23693aaaa9aa0d3e9eca0ae77d1be80ab3 |
