Description
In the Linux kernel, the following vulnerability has been resolved: net: rds: fix MR cleanup on copy error __rds_rdma_map() hands sg/pages ownership to the transport after get_mr() succeeds. If copying the generated cookie back to user space fails after that point, the error path must not free those resources again before dropping the MR reference. Remove the duplicate unpin/free from the put_user() failure branch so that MR teardown is handled only through the existing final cleanup path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0d4597c8c5abdeeaf50774066c16683f30184dc8 to < 91a44b406bc1f9e1c5da0cb7d0d5991b43b79147affected0d4597c8c5abdeeaf50774066c16683f30184dc8 to < 106dc689206610cfa2098f593fdd1e020c997835affected0d4597c8c5abdeeaf50774066c16683f30184dc8 to < ec55a86f7fba7d9111df94b9c11a4755ed492995affected0d4597c8c5abdeeaf50774066c16683f30184dc8 to < 8fdbb6262a4a3ed44a0830a7793903b54bb27bdcaffected0d4597c8c5abdeeaf50774066c16683f30184dc8 to < d95cea9298be1ba8876e3f156be96d3a492085caaffected0d4597c8c5abdeeaf50774066c16683f30184dc8 to < 033370ffb3c9c0264d19f8ba9ef769523266589aaffected0d4597c8c5abdeeaf50774066c16683f30184dc8 to < b3cb8cae530b2727d8245684148bb49425f6765caffected0d4597c8c5abdeeaf50774066c16683f30184dc8 to < 8141a2dc70080eda1aedc0389ed2db2b292af5bdaffected
Linux Linux
Default version status: affected
5.6affected0 to < 5.6unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.86 to ≤ 6.12.*unaffected6.18.27 to ≤ 6.18.*unaffected7.0.4 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/91a44b406bc1f9e1c5da0cb7d0d5991b43b79147 ↗
- https://git.kernel.org/stable/c/106dc689206610cfa2098f593fdd1e020c997835 ↗
- https://git.kernel.org/stable/c/ec55a86f7fba7d9111df94b9c11a4755ed492995 ↗
- https://git.kernel.org/stable/c/8fdbb6262a4a3ed44a0830a7793903b54bb27bdc ↗
- https://git.kernel.org/stable/c/d95cea9298be1ba8876e3f156be96d3a492085ca ↗
- https://git.kernel.org/stable/c/033370ffb3c9c0264d19f8ba9ef769523266589a ↗
- https://git.kernel.org/stable/c/b3cb8cae530b2727d8245684148bb49425f6765c ↗
- https://git.kernel.org/stable/c/8141a2dc70080eda1aedc0389ed2db2b292af5bd ↗