Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2024-38555

net/mlx5: Discard command completions in internal error

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually. Kernel log: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: <IRQ> ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0xa0 common_interrupt+0x7b/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 27c79b3a9212cf4ba634c157e07d29548181a208 to < f6fbb8535e990f844371086ab2c1221f71f993d3affected
  • 51d138c2610a236c1ed0059d034ee4c74f452b86 to < 3cb92b0ad73d3f1734e812054e698d655e9581b0affected
  • 51d138c2610a236c1ed0059d034ee4c74f452b86 to < bf8aaf0ae01c27ae3c06aa8610caf91e50393396affected
  • 51d138c2610a236c1ed0059d034ee4c74f452b86 to < 1337ec94bc5a9eed250e33f5f5c89a28a6bfabdbaffected
  • 51d138c2610a236c1ed0059d034ee4c74f452b86 to < 1d5dce5e92a70274de67a59e1e674c3267f94cd7affected
  • 51d138c2610a236c1ed0059d034ee4c74f452b86 to < 7ac4c69c34240c6de820492c0a28a0bd1494265aaffected
  • 51d138c2610a236c1ed0059d034ee4c74f452b86 to < db9b31aa9bc56ff0d15b78f7e827d61c4a096e40affected
  • 2e5d24b3bf091802c5456dc8f8f6a6be4493c8caaffected
  • 5.10.20 to < 5.10.219affected
  • 5.11.3 to < 5.12affected

Linux Linux

Default version status: affected

  • 5.12affected
  • 0 to < 5.12unaffected
  • 5.10.219 to ≤ 5.10.*unaffected
  • 5.15.161 to ≤ 5.15.*unaffected
  • 6.1.93 to ≤ 6.1.*unaffected
  • 6.6.33 to ≤ 6.6.*unaffected
  • 6.8.12 to ≤ 6.8.*unaffected
  • 6.9.3 to ≤ 6.9.*unaffected
  • 6.10 to ≤ *unaffected

References