Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDR_RESOLVED handler via ib_cq_pool_get(), before the peer is connected. create_cm() can return -ERESTARTSYS from wait_event_interruptible_timeout() without destroying the CM ID. The init_conns() and stop-and-destroy paths then call destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards rdma_destroy_id(). CMA serializes the handler against rdma_destroy_id() with handler_mutex, but that does not order the GET against destroy_con_cq_qp(). If ADDR_RESOLVED has already passed the DESTROYING check, it can take con_mutex, GET credits, and then lose the con to kfree. Device unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup(). Set a per-connection flag under con_mutex before CQ/QP teardown so a racing ADDR_RESOLVED cannot borrow credits after teardown has begun.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3b89e92c2a95a39c38a3808f4528e502a39bd94d to < a82cca40139d9fcae8208901856bd5bb4051f097affected3b89e92c2a95a39c38a3808f4528e502a39bd94d to < 74c4ed55e61f1b65ddbebc5b635d136461a1c3daaffected3b89e92c2a95a39c38a3808f4528e502a39bd94d to < 6f8020fe7465f49e234a576c04e415e9d08c7878affected3b89e92c2a95a39c38a3808f4528e502a39bd94d to < 31024e158b45358370a0a14ed96589e6aa62d6cbaffected3b89e92c2a95a39c38a3808f4528e502a39bd94d to < 8f253d5893f991742464b9e7203c43fc08d0aa11affected3b89e92c2a95a39c38a3808f4528e502a39bd94d to < bf88ac4867050112a6c819c8d1a7209bf48ef427affected3b89e92c2a95a39c38a3808f4528e502a39bd94d to < 2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcdaaffected
Linux Linux
Default version status: affected
5.13affected0 to < 5.13unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a82cca40139d9fcae8208901856bd5bb4051f097 ↗
- https://git.kernel.org/stable/c/74c4ed55e61f1b65ddbebc5b635d136461a1c3da ↗
- https://git.kernel.org/stable/c/6f8020fe7465f49e234a576c04e415e9d08c7878 ↗
- https://git.kernel.org/stable/c/31024e158b45358370a0a14ed96589e6aa62d6cb ↗
- https://git.kernel.org/stable/c/8f253d5893f991742464b9e7203c43fc08d0aa11 ↗
- https://git.kernel.org/stable/c/bf88ac4867050112a6c819c8d1a7209bf48ef427 ↗
- https://git.kernel.org/stable/c/2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda ↗