In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
bnxt_rx_ring_reset() frees the ring buffers and then reallocates them,
ignoring the result.
bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which
returns -ENOMEM on the first failed allocation and leaves the remaining
rxr->rx_tpa[] entries zeroed.
The error isn't propagated up, so the loop in bnxt_rx_ring_reset
continues and at the end the code re-enables TPA with partially
unallocated rx_tpa array.
This means that when the agg_id from hardware is mapped to a SW index in
rxr->rx_tpa[], an uninitialized slot can be chosen which would hand a
zero DMA address to the device.
Fix this by falling back to a global reset, which is what the existing
code already does when other functions fail, but unlike the other
failure cases this particular failure has to return because TPA can't
be re-enabled since the allocation failed.
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.1
AV:N - The fixed function bnxt_rx_ring_reset() is a driver error path with no malformed input. What it damages is received data: bnxt_tpa_start() hands the NIC a stale rx_tpa[] mapping, and the NIC DMAs packet bytes sent by a remote host into that freed buffer. The remote peer supplies the data that gets written, so the vector is Network.
AC:H - Two things must happen together. A pre-P5 chip must hit an RX buffer error, cons mismatch or ring-monitor event that schedules the per-ring reset, and the GFP_KERNEL refill in bnxt_alloc_one_tpa_info_data() must fail under memory pressure. A remote sender cannot force that allocation failure.
PR:N - No authentication is involved. Any host that can send TCP traffic that the NIC aggregates with TPA (hardware GRO/LRO) fills the stale buffers and can also generate the traffic that leads to RX buffer errors.
UI:N - No user action is needed. The reset runs from the bnxt sp_task workqueue, and the bad TPA slot is used as soon as TPA_START completions arrive.
S:U - The corruption hits kernel memory on the host that owns the NIC, which is the same authority as the driver. No VM or other security boundary is crossed.
C:H - bnxt_free_one_tpa_info_data() clears tpa_info->data but leaves tpa_info->mapping stale. The NIC then writes into a page returned to page_pool that can be reused, and a reused buffer carrying other data can end up delivered as the next RX packet.
I:H - The device DMA-writes TCP payload bytes chosen by the remote sender into freed memory (bnxt_tpa_start() puts the stale mapping into rx_bd_haddr). That is a write into memory the kernel may have reused, with attacker-chosen contents.
A:H - The NULL tpa_info->data is moved into rx_buf_ring by bnxt_tpa_start(). When that buffer is consumed, the RX path dereferences NULL, and on top of that the stray DMA corrupts memory, so the kernel crashes.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
High |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The fixed function bnxt_rx_ring_reset() is a driver error path with no malformed input. What it damages is received data: bnxt_tpa_start() hands the NIC a stale rx_tpa[] mapping, and the NIC DMAs packet bytes sent by a remote host into that freed buffer. The remote peer supplies the data that gets written, so the vector is Network.
AC:H - Two things must happen together. A pre-P5 chip must hit an RX buffer error, cons mismatch or ring-monitor event that schedules the per-ring reset, and the GFP_KERNEL refill in bnxt_alloc_one_tpa_info_data() must fail under memory pressure. A remote sender cannot force that allocation failure.
PR:N - No authentication is involved. Any host that can send TCP traffic that the NIC aggregates with TPA (hardware GRO/LRO) fills the stale buffers and can also generate the traffic that leads to RX buffer errors.
UI:N - No user action is needed. The reset runs from the bnxt sp_task workqueue, and the bad TPA slot is used as soon as TPA_START completions arrive.
S:U - The corruption hits kernel memory on the host that owns the NIC, which is the same authority as the driver. No VM or other security boundary is crossed.
C:H - bnxt_free_one_tpa_info_data() clears tpa_info->data but leaves tpa_info->mapping stale. The NIC then writes into a page returned to page_pool that can be reused, and a reused buffer carrying other data can end up delivered as the next RX packet.
I:H - The device DMA-writes TCP payload bytes chosen by the remote sender into freed memory (bnxt_tpa_start() puts the stale mapping into rx_bd_haddr). That is a write into memory the kernel may have reused, with attacker-chosen contents.
A:H - The NULL tpa_info->data is moved into rx_buf_ring by bnxt_tpa_start(). When that buffer is consumed, the RX path dereferences NULL, and on top of that the stray DMA corrupts memory, so the kernel crashes.
CVSS 3.1