CVE-2022-50679
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-50679
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50679.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-50679
- Downstream
- Published
- 2025-12-09T01:29:32.925Z
- Modified
- 2025-12-09T03:34:08.476880Z
- Summary
- i40e: Fix DMA mappings leak
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
i40e: Fix DMA mappings leak
During reallocation of RX buffers, new DMA mappings are created for those buffers.
steps for reproduction: while : do for ((i=0; i<=8160; i=i+32)) do ethtool -G enp130s0f0 rx $i tx $i sleep 0.5 ethtool -g enp130s0f0 done done
This resulted in crash: i40e 0000:01:00.1: Unable to allocate memory for the Rx descriptor ring, size=65536 Driver BUG WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:141 xdprxqinfounreg+0x43/0x50 Call Trace: i40efreerxresources+0x70/0x80 [i40e] i40esetringparam+0x27c/0x800 [i40e] ethnlsetrings+0x1b2/0x290 genlfamilyrcvmsgdoit.isra.15+0x10f/0x150 genlfamilyrcvmsg+0xb3/0x160 ? ringsfillreply+0x1a0/0x1a0 genlrcvmsg+0x47/0x90 ? genlfamilyrcvmsg+0x160/0x160 netlinkrcvskb+0x4c/0x120 genlrcv+0x24/0x40 netlinkunicast+0x196/0x230 netlinksendmsg+0x204/0x3d0 socksendmsg+0x4c/0x50 _syssendto+0xee/0x160 ? handlemmfault+0xbe/0x1e0 ? syscalltraceenter+0x1d3/0x2c0 _x64syssendto+0x24/0x30 dosyscall64+0x5b/0x1a0 entrySYSCALL64afterhwframe+0x65/0xca RIP: 0033:0x7f5eac8b035b Missing register, driver bug WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:119 xdprxqinfounregmemmodel+0x69/0x140 Call Trace: xdprxqinfounreg+0x1e/0x50 i40efreerxresources+0x70/0x80 [i40e] i40esetringparam+0x27c/0x800 [i40e] ethnlsetrings+0x1b2/0x290 genlfamilyrcvmsgdoit.isra.15+0x10f/0x150 genlfamilyrcvmsg+0xb3/0x160 ? ringsfillreply+0x1a0/0x1a0 genlrcvmsg+0x47/0x90 ? genlfamilyrcvmsg+0x160/0x160 netlinkrcvskb+0x4c/0x120 genlrcv+0x24/0x40 netlinkunicast+0x196/0x230 netlinksendmsg+0x204/0x3d0 socksendmsg+0x4c/0x50 _syssendto+0xee/0x160 ? handlemmfault+0xbe/0x1e0 ? syscalltraceenter+0x1d3/0x2c0 _x64syssendto+0x24/0x30 dosyscall64+0x5b/0x1a0 entrySYSCALL64after_hwframe+0x65/0xca RIP: 0033:0x7f5eac8b035b
This was caused because of new buffers with different RX ring count should substitute older ones, but those buffers were freed in i40econfigurerxring and reallocated again with i40eallocrxbi, thus kfree on rx_bi caused leak of already mapped DMA.
Fix this by reallocating ZC with rxbizc struct when BPF program loads. Additionally reallocate back to rx_bi when BPF program unloads.
If BPF program is loaded/unloaded and XSK pools are created, reallocate RX queues accordingly in XSPSETUPXSK_POOL handler.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50679.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/5f499596dfa3db9b3172645b6de9e1096a669c95
- https://git.kernel.org/stable/c/94a171c982b8a8137a00721c1e62bc2713435bca
- https://git.kernel.org/stable/c/aae425efdfd1b1d8452260a3cb49344ebf20b1f5
- https://git.kernel.org/stable/c/ed5baf3d0a33caaca4cd4073ebb0854cc77a616d
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50679.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-50679
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbe1222b585fdc410b8c1dbcc57dd03a00f04eff5Fixeded5baf3d0a33caaca4cd4073ebb0854cc77a616dFixed94a171c982b8a8137a00721c1e62bc2713435bcaFixed5f499596dfa3db9b3172645b6de9e1096a669c95Fixedaae425efdfd1b1d8452260a3cb49344ebf20b1f5