Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ec3eead217181d7360a11317a888ceb30807867c to < 5fe4731bfbd8d83c4a14b4af3a27329969ce8a99affectedec3eead217181d7360a11317a888ceb30807867c to < 8f6976d635d190e3d7af7103daaa581cf1ccc12eaffectedec3eead217181d7360a11317a888ceb30807867c to < 9eeafcda1d6c11f0eec532243c4e96ec8c632bd7affectedec3eead217181d7360a11317a888ceb30807867c to < 5a21e5114cec4cd3f8a2843d4c46bc49634d6e96affectedec3eead217181d7360a11317a888ceb30807867c to < 2f17ca7ab5269ac2504e1039c3921373dccd7712affectedec3eead217181d7360a11317a888ceb30807867c to < a2e37d1ab773be3cd26b1c19593ca2dbcece9c57affectedec3eead217181d7360a11317a888ceb30807867c to < a64e2beb450179a5d43034af8d5476a11eac1486affectedec3eead217181d7360a11317a888ceb30807867c to < fdfb5cea4bf070cdb31d997efd87bb684df041fdaffected
Linux Linux
Default version status: affected
3.5affected0 to < 3.5unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99 ↗
- https://git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e ↗
- https://git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7 ↗
- https://git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96 ↗
- https://git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712 ↗
- https://git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57 ↗
- https://git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486 ↗
- https://git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd ↗