Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to < 9fff54929cc00849d738faa99f06c32399aeb026affectede126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to < b746f949c2ac2b041102836095d6d4a2ef21fa75affectede126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to < c1dbf52d24a8cb1aa56780ba51b72e7d495f258caffectede126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to < 6fc874fdfb366bfb11c62e6af9a831c8be59dddaaffectede126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to < 42f3d2c8c18b92ea33e506a38b64f1a8986c2823affectede126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to < 4b87a2497276a72fd63028e7419abf0fb7ed837baffectede126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to < b732db02a2b04cde393638df19de6251ce62a74eaffectede126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to < d881d60223aac8fdc12b227d89c76e131e92a9cdaffected
Linux Linux
Default version status: affected
3.11affected0 to < 3.11unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026 ↗
- https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75 ↗
- https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c ↗
- https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda ↗
- https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823 ↗
- https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b ↗
- https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e ↗
- https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd ↗