Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wrong because if the completer task is already running in a separate thread it may have already processed the skb and freed it which can cause a seg fault. This has been observed infrequently in testing at high scale. This patch fixes this by changing the order of enqueuing the packet until after the counter is accessed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0b1e5b99a48b5b810e3e38f1d6e0d39306b99ec0 to < c91fb72a2ca6480d8d77262eef52dc5b178463a3affected0b1e5b99a48b5b810e3e38f1d6e0d39306b99ec0 to < de5a059e36657442b5637cc16df5163e435b9cb4affected0b1e5b99a48b5b810e3e38f1d6e0d39306b99ec0 to < e0e14dd35d4242340c7346aac60c7ff8fbf87ffcaffected0b1e5b99a48b5b810e3e38f1d6e0d39306b99ec0 to < faa8d0ecf6c9c7c2ace3ca3e552180ada6f75e19affected0b1e5b99a48b5b810e3e38f1d6e0d39306b99ec0 to < 21b4c6d4d89030fd4657a8e7c8110fd941049794affected0b1e5b99a48b5b810e3e38f1d6e0d39306b99ec0 to < bbad88f111a1829f366c189aa48e7e58e57553fcaffected0b1e5b99a48b5b810e3e38f1d6e0d39306b99ec0 to < 30df4bef8b8e183333e9b6e9d4509d552c7da6ebaffected0b1e5b99a48b5b810e3e38f1d6e0d39306b99ec0 to < 2b23b6097303ed0ba5f4bc036a1c07b6027af5c6affected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.4.285 to ≤ 5.4.*unaffected5.10.227 to ≤ 5.10.*unaffected5.15.168 to ≤ 5.15.*unaffected6.1.93 to ≤ 6.1.*unaffected6.6.33 to ≤ 6.6.*unaffected6.8.12 to ≤ 6.8.*unaffected6.9.3 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c91fb72a2ca6480d8d77262eef52dc5b178463a3 ↗
- https://git.kernel.org/stable/c/de5a059e36657442b5637cc16df5163e435b9cb4 ↗
- https://git.kernel.org/stable/c/e0e14dd35d4242340c7346aac60c7ff8fbf87ffc ↗
- https://git.kernel.org/stable/c/faa8d0ecf6c9c7c2ace3ca3e552180ada6f75e19 ↗
- https://git.kernel.org/stable/c/21b4c6d4d89030fd4657a8e7c8110fd941049794 ↗
- https://git.kernel.org/stable/c/bbad88f111a1829f366c189aa48e7e58e57553fc ↗
- https://git.kernel.org/stable/c/30df4bef8b8e183333e9b6e9d4509d552c7da6eb ↗
- https://git.kernel.org/stable/c/2b23b6097303ed0ba5f4bc036a1c07b6027af5c6 ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗