Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr. This leaks a refcount and triggers a WARN: GID entry ref leak for dev syz1 index 2 ref=573 WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline] WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886 Destroy the ah_attr after canceling the work, it is safe to call this twice.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
60d613b39e8d0c9f3b526e9c96445422b4562d76 to < d5ce588a9552878859a4d44b70b724216c188a5faffectedfe454dc31e84f8c14cb8942fcb61666c9f40745b to < abf38398724ecc888f62c678d288da40d11878afaffectedfe454dc31e84f8c14cb8942fcb61666c9f40745b to < ab668a58c4a2ccb6d54add7a76f2f955d15d0196affectedfe454dc31e84f8c14cb8942fcb61666c9f40745b to < c0acdee513239e1d6e1b490f56be0e6837dfd162affectedfe454dc31e84f8c14cb8942fcb61666c9f40745b to < 5cb34bb5fd726491b809efbeb5cfd63ae5bf9cf3affectedfe454dc31e84f8c14cb8942fcb61666c9f40745b to < 3ba6d01c4b3c584264dc733c6a2ecc5bbc8e0bb5affectedfe454dc31e84f8c14cb8942fcb61666c9f40745b to < 57f3cb6c84159d12ba343574df2115fb18dd83caaffecteda3262b3884dd67b4c5632ce7cdf9cff9d1a575d4affected5.10.20 to < 5.10.248affected5.11.3 to < 5.12affected
Linux Linux
Default version status: affected
5.12affected0 to < 5.12unaffected5.10.248 to ≤ 5.10.*unaffected5.15.198 to ≤ 5.15.*unaffected6.1.160 to ≤ 6.1.*unaffected6.6.120 to ≤ 6.6.*unaffected6.12.64 to ≤ 6.12.*unaffected6.18.4 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d5ce588a9552878859a4d44b70b724216c188a5f ↗
- https://git.kernel.org/stable/c/abf38398724ecc888f62c678d288da40d11878af ↗
- https://git.kernel.org/stable/c/ab668a58c4a2ccb6d54add7a76f2f955d15d0196 ↗
- https://git.kernel.org/stable/c/c0acdee513239e1d6e1b490f56be0e6837dfd162 ↗
- https://git.kernel.org/stable/c/5cb34bb5fd726491b809efbeb5cfd63ae5bf9cf3 ↗
- https://git.kernel.org/stable/c/3ba6d01c4b3c584264dc733c6a2ecc5bbc8e0bb5 ↗
- https://git.kernel.org/stable/c/57f3cb6c84159d12ba343574df2115fb18dd83ca ↗