CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: guard flow control update with globaltxfc in buffer switching
mvpp2bmswitchbuffers() unconditionally calls mvpp2bmpoolupdateprivfc() when switching between per-cpu and shared buffer pool modes. This function programs CM3 flow control registers via mvpp2cm3read()/mvpp2cm3write(), which dereference priv->cm3base without any NULL check.
When the CM3 SRAM resource is not present in the device tree (the third reg entry added by commit 60523583b07c ("dts: marvell: add CM3 SRAM memory to cp11x ethernet device tree")), priv->cm3base remains NULL and priv->globaltxfc is false. Any operation that triggers mvpp2bmswitchbuffers(), for example an MTU change that crosses the jumbo frame threshold, will crash:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits pc : readl+0x0/0x18 lr : mvpp2cm3read.isra.0+0x14/0x20 Call trace: readl+0x0/0x18 mvpp2bmpoolupdatefc+0x40/0x12c mvpp2bmpoolupdateprivfc+0x94/0xd8 mvpp2bmswitchbuffers.isra.0+0x80/0x1c0 mvpp2changemtu+0x140/0x380 devsetmtu+0x1c/0x38 devsetmtuext+0x78/0x118 devsetmtu+0x48/0xa8 devifsioc+0x21c/0x43c devioctl+0x2d8/0x42c sockioctl+0x314/0x378
Every other flow control call site in the driver already guards hardware access with either priv->globaltxfc or port->txfc. mvpp2bmswitchbuffers() is the only place that omits this check.
Add the missing priv->globaltxfc guard to both the disable and re-enable calls in mvpp2bmswitchbuffers(), consistent with the rest of the driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In mvpp2_bm_switch_buffers(), add the missing NULL/priv->global_tx_fc guard so the flow-control update is only performed when priv->global_tx_fc is true and priv->cm3_base is valid; re-enable/restore the global_tx_fc guard consistent with the rest of the driver and to prevent NULL pointer dereference when the CM3 SRAM resource is not present in the device tree.
Linux kernel driver (net: mvpp2) priv->global_tx_fc guard = Add condition checks in mvpp2_bm_switch_buffers()