Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed, leaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN identifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and permanently disables the command queue, so no retry can succeed; the RDMA core keeps the object after a failed destructor and forced uverbs cleanup then nulls the pointers, making the resources unreachable. Warn on failure but release every software-owned resource and return success, since during terminal destruction the hardware command result is only diagnostic.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
155055771704f8cbb5c176a4309b7dc30a50450c to < 4f5cd6a2081ec956db25b8e9f71d052f68d522c7affected155055771704f8cbb5c176a4309b7dc30a50450c to < 3886d944b506e0cc681646beb03c3024cb375a68affected155055771704f8cbb5c176a4309b7dc30a50450c to < 5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabeaffected155055771704f8cbb5c176a4309b7dc30a50450c to < ce7d205c264665517c25e8a3231cf2d0c2443e3caffected155055771704f8cbb5c176a4309b7dc30a50450c to < 334145d683ad3e31d052247f10807f2ebc950351affected155055771704f8cbb5c176a4309b7dc30a50450c to < 652befcba956ef357f480525ccbe25c59bc81d4daffected
Linux Linux
Default version status: affected
6.0affected0 to < 6.0unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4f5cd6a2081ec956db25b8e9f71d052f68d522c7 ↗
- https://git.kernel.org/stable/c/3886d944b506e0cc681646beb03c3024cb375a68 ↗
- https://git.kernel.org/stable/c/5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabe ↗
- https://git.kernel.org/stable/c/ce7d205c264665517c25e8a3231cf2d0c2443e3c ↗
- https://git.kernel.org/stable/c/334145d683ad3e31d052247f10807f2ebc950351 ↗
- https://git.kernel.org/stable/c/652befcba956ef357f480525ccbe25c59bc81d4d ↗