Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iw_alloc() creates the per-device debugfs tree (dev->debugfs_root via setup_debugfs()), but it is removed only in c4iw_remove(), not in c4iw_dealloc(). When RDMA device registration fails, the registration worker's err_dealloc_ctx path calls c4iw_dealloc() directly, bypassing c4iw_remove(), so the debugfs dentries leak and outlive the freed c4iw_dev. Move debugfs_remove_recursive() into c4iw_dealloc() so every path that frees ctx->dev also removes its debugfs tree.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
49ea0c036ede81f126f1a9389d377999fdf5c5a1 to < 459b59f7ed56511d6529311cb4e5e482ebfcfb8eaffected49ea0c036ede81f126f1a9389d377999fdf5c5a1 to < cd60992f09b7e83bfd3c76e3bb06b29f3e2fa0a8affected49ea0c036ede81f126f1a9389d377999fdf5c5a1 to < c332d9e7dce234d8bef78271d003a68ee943b61baffected49ea0c036ede81f126f1a9389d377999fdf5c5a1 to < f98e894ec029a752cf9c7f7834741bead0fb463daffected49ea0c036ede81f126f1a9389d377999fdf5c5a1 to < 479a7f90060e62bdd9bb4036ec0a70bf460f6d23affected49ea0c036ede81f126f1a9389d377999fdf5c5a1 to < 046425412529dbfca1433c8bef5641b271b4ab2aaffected49ea0c036ede81f126f1a9389d377999fdf5c5a1 to < ea41b5630fa3d9877ce9ed8832cf5575f742bfbbaffected49ea0c036ede81f126f1a9389d377999fdf5c5a1 to < fe5c16bb6252dea6025b748257ddc3b2665495b0affected98fa991017981b52dcc4dc3924fc8e1e83e41bf4affectedaf92e4a595e006b498c44b617ea38f697eca3469affected9c0cec79e5c914662c2cf98b4a729c0fcc8c872eaffected4.19.130 to < 4.20affected5.4.49 to < 5.5affected5.7.6 to < 5.8affected
Linux Linux
Default version status: affected
5.8affected0 to < 5.8unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/459b59f7ed56511d6529311cb4e5e482ebfcfb8e ↗
- https://git.kernel.org/stable/c/cd60992f09b7e83bfd3c76e3bb06b29f3e2fa0a8 ↗
- https://git.kernel.org/stable/c/c332d9e7dce234d8bef78271d003a68ee943b61b ↗
- https://git.kernel.org/stable/c/f98e894ec029a752cf9c7f7834741bead0fb463d ↗
- https://git.kernel.org/stable/c/479a7f90060e62bdd9bb4036ec0a70bf460f6d23 ↗
- https://git.kernel.org/stable/c/046425412529dbfca1433c8bef5641b271b4ab2a ↗
- https://git.kernel.org/stable/c/ea41b5630fa3d9877ce9ed8832cf5575f742bfbb ↗
- https://git.kernel.org/stable/c/fe5c16bb6252dea6025b748257ddc3b2665495b0 ↗