Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: drain QP references after partial table insertion mana_table_store_ud_qp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xa_insert_irq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free. Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8001e9257eca23264550ff9e34598ee43a80f0f9 to < 4aaa2ab816c710be7385b31d08373edcdcd71656affected8001e9257eca23264550ff9e34598ee43a80f0f9 to < 638b9a5364c1482e5d104823c1a3884b3d249484affected8001e9257eca23264550ff9e34598ee43a80f0f9 to < 97f7c2262c28ebcae64fc957ee978646684a5ed9affected
Linux Linux
Default version status: affected
6.15affected0 to < 6.15unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected