CVE-2026-90079: octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: fix cn20k mailbox lifetime on repeated rvumboxinit()
rvumboxinit() is called separately for AF-PF mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled. Each call used to allocate a new ngrvu object, leaking the first allocation when the pointer was overwritten on the second call.
Sharing one ngrvu across both paths exposed several teardown bugs: the error path freed all cn20k mailbox DMA and kfree()d ngrvu even when only the failing init type should be unwound, leaving live AF-PF mailbox memory in use after an AF-VF init failure. mutexinit() was also re-run on the AF-VF path while AF-PF mailbox handlers could still hold rvu->mboxlock. Probe and SR-IOV failure paths did not release cn20k mailbox DMA either, since cleanup only happened in rvuremove().
Allocate ngrvu once with devmkzalloc(), initialize mboxlock in the same block, unwind only the mailbox memory for the failing init type, and free cn20k mailbox DMA from the probe and pcienablesriov() error paths.
Event History
Frequently Asked Questions
When can this issue be triggered?
It is relevant when AF-PF mailboxes are initialized during device probe and AF-VF mailboxes are later initialized as part of enabling SR-IOV. The problematic lifetime handling occurs when rvu_mbox_init() is invoked separately for those two mailbox types.
What operational impact can occur if AF-VF mailbox initialization fails?
An AF-VF initialization failure could free shared cn20k mailbox resources and the ng_rvu object while AF-PF mailbox memory remains live, creating use-after-free conditions. The affected error paths could also fail to release cn20k mailbox DMA memory.
Is SR-IOV configuration relevant to exposure?
Yes. The second mailbox initialization path is used when SR-IOV is enabled, so systems that do not enable SR-IOV do not exercise that AF-VF initialization path described here.
What does the fix change for failure handling?
The fix allocates ng_rvu once, initializes the mailbox lock only with that allocation, and unwinds mailbox memory only for the initialization type that failed. It also releases cn20k mailbox DMA from probe and SR-IOV enable error paths.