CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

mlx5e_hv_vhca_stats_create() is called from mlx5e_nic_enable(),
before mlx5e_open(). At that point priv->stats_nch is still zero,
because it is only ever incremented in mlx5e_channel_stats_alloc(),
which is reached only from mlx5e_open_channel().

mlx5e_hv_vhca_stats_buf_size() therefore returns 0, and
kvzalloc(0, GFP_KERNEL) returns ZERO_SIZE_PTR ((void *)16) rather
than NULL. The "if (!buf)" guard does not catch this, and
mlx5e_hv_vhca_stats_create() completes "successfully" with
priv->stats_agent.buf set to ZERO_SIZE_PTR.

Once channels are opened (priv->stats_nch > 0) and the hypervisor
enables stats reporting, mlx5e_hv_vhca_stats_work() recomputes
buf_len using the new non-zero stats_nch and calls
memset(buf, 0, buf_len) on ZERO_SIZE_PTR, faulting at address 0x10.

Allocate the buffer based on priv->max_nch, which is set in
mlx5e_priv_init() and is the upper bound on stats_nch:

  - Add a separate helper mlx5e_hv_vhca_stats_buf_max_size() that
    returns sizeof(per_ring_stats) * max(max_nch, stats_nch), and
    use it for the kvzalloc() in mlx5e_hv_vhca_stats_create().
  - Keep mlx5e_hv_vhca_stats_buf_size() (which returns based on
    stats_nch) for the worker's active payload size, so the wire
    format (block->rings = stats_nch) and the amount of data filled
    by mlx5e_hv_vhca_fill_stats() are unchanged.

The max(max_nch, stats_nch) guard handles the rare case where
mlx5e_attach_netdev() recomputes max_nch downward across a
detach/resume cycle while priv->stats_nch persists (mlx5e_detach_netdev
does not call mlx5e_priv_cleanup, so stats_nch is only reset when
the netdev is destroyed). Without the guard, the worker could compute
buf_len from stats_nch and overrun the smaller buffer allocated based
on the reduced max_nch.

Allocating a non-zero buffer also makes the kvzalloc() failure path in
mlx5e_hv_vhca_stats_create() reachable for the first time: it returns
early without (re)creating the agent. Clear
priv->stats_agent.{agent,buf} in mlx5e_hv_vhca_stats_destroy() after
freeing them, so that if a later create() bails out on this path, a
subsequent teardown does not double-free the stale agent/buffer left
from a previous enable/disable cycle.

This mirrors the existing mlx5e pattern of preallocating arrays of
size max_nch (e.g. priv->channel_stats) and lazily populating
entries up to stats_nch on demand.

The Linux kernel CVE team has assigned CVE-2026-72343 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit fa691d0c9c0812b9045f3a9420862e47b3b92518 and fixed in 6.1.178 with commit 3b3a552cf88e10bb7bda88b29cf1fd8267043d50
	Issue introduced in 5.17 with commit fa691d0c9c0812b9045f3a9420862e47b3b92518 and fixed in 6.6.145 with commit 5b927dcec5f1087942bf123a82e64a3f66475f01
	Issue introduced in 5.17 with commit fa691d0c9c0812b9045f3a9420862e47b3b92518 and fixed in 6.12.97 with commit 22c1d5ecccf92c849bdca1556179aafc95794baf
	Issue introduced in 5.17 with commit fa691d0c9c0812b9045f3a9420862e47b3b92518 and fixed in 6.18.40 with commit 420aabb32da4381d8d7cdcaa6a77fad9eaceb0a4
	Issue introduced in 5.17 with commit fa691d0c9c0812b9045f3a9420862e47b3b92518 and fixed in 7.1.5 with commit abc4c56427f144c96b2827a4db3b90eb5b7349a2
	Issue introduced in 5.17 with commit fa691d0c9c0812b9045f3a9420862e47b3b92518 and fixed in 7.2-rc3 with commit 25f6b929c7e379cbea7cb8caa67b49b2d1efae17

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72343
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3b3a552cf88e10bb7bda88b29cf1fd8267043d50
	https://git.kernel.org/stable/c/5b927dcec5f1087942bf123a82e64a3f66475f01
	https://git.kernel.org/stable/c/22c1d5ecccf92c849bdca1556179aafc95794baf
	https://git.kernel.org/stable/c/420aabb32da4381d8d7cdcaa6a77fad9eaceb0a4
	https://git.kernel.org/stable/c/abc4c56427f144c96b2827a4db3b90eb5b7349a2
	https://git.kernel.org/stable/c/25f6b929c7e379cbea7cb8caa67b49b2d1efae17