CVE-2024-56719

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix TSO DMA API usage causing oops

Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap

for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s

members to be later in stmmac_tso_xmit().

The buf (dma cookie) and len stored in this structure are passed to

dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that

the dma cookie passed to dma_unmap_single() is the same as the value

returned from dma_map_single(). However, by moving the assignment

later, this is not the case when priv->dma_cap.addr64 > 32 as "des"

is offset by proto_hdr_len.

This causes problems such as:

dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed

and with DMA_API_DEBUG enabled:

DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes]

Fix this by maintaining "des" as the original DMA cookie,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References