Linux Kernel Mana Driver Null Pointer Dereference Vulnerability in Detached Port Handling

A vulnerability in the Linux kernel's Microsoft Mana Ethernet driver can lead to null pointer dereferences during queue teardown. This issue occurs when the port is left in a detached state after a successful detach operation, but the subsequent attach attempt fails. In this scenario, the driver's transmit and receive queue pointers are freed, and an unconditional call to detach the port again causes a null pointer dereference. The vulnerability affects the Linux kernel stable tree.

Impact

The vulnerability can be exploited to cause null pointer dereferences, leading to crashes or undefined behavior in the kernel.

Reproduction

The vulnerability can be reproduced by allowing the 'mana_per_port_queue_reset_work_handler' to run after a detach operation has succeeded but the attach operation has failed. This sequence leaves the port detached, with its queue pointers already freed. Calling 'mana_detach' again without checking the port's state leads to a null pointer dereference during the queue teardown process.

Remediation

The vulnerability has been addressed by modifying the 'mana_detach' function to include an early exit when the port is already detached. This change prevents redundant detach operations and allows recovery processes to safely retry attaching the port without causing a null pointer dereference.