Double Invocation Guard in Linux Kernel Mana Driver

Executive Summary

This vulnerability exists in the Linux kernel's mana network driver. When the system resumes from power management (PM) suspend, if the resume process fails (for example, if mana_attach() returns an error), the function mana_probe() calls mana_remove() to tear down the device and clear certain context pointers.

However, because a failed resume callback does not automatically unbind the driver, the device can later be unbound, causing mana_remove() to be called a second time. During this second call, the code attempts to dereference a NULL pointer (gc->dev) because the context pointer gc is NULL, which leads to a kernel panic.

The fix involves adding a check to return early if the context pointers are NULL, preventing the second invocation from causing a crash, and rearranging the code to avoid dereferencing NULL pointers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a kernel panic, which is a critical system crash in the Linux kernel. Such a crash can lead to system instability, unexpected reboots, or downtime.

If exploited or triggered, it could disrupt services running on the affected system, potentially causing data loss or interruption of operations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the fix has been applied. The fix involves adding a NULL check in the mana_remove function to prevent double invocation and kernel panic.

Specifically, update your system to include the patch that adds an early return if gdma_context or driver_data is NULL, preventing the second invocation from causing a kernel panic.

Until the update is applied, avoid scenarios that trigger PM resume failures or device unbinding that could cause mana_remove to be called twice.

Useful 0 Not Useful 0