Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs ib_mad_enforce_security() before linking recv_buf onto that list. On failure it calls ib_free_recv_mad(), which only walks rmpp_list and frees the ib_mad_private of every buffer found there. As the list is still empty at that point, nothing is freed at all. The caller cannot clean up either: ib_mad_recv_done() sets recv to NULL right after ib_mad_complete_recv() returns, assuming the MAD layer took ownership of the buffer. Every MAD that fails the PKey check therefore leaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA), and a remote node can trigger this repeatedly by sending MADs with a wrong PKey. Link recv_buf onto rmpp_list right after the list is initialized, so the error path has something to free.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
47a2b338fe63200d716d2e24131cdb49f17c77da to < 4617c9a856188674dddb0ca66979746d07688579affected47a2b338fe63200d716d2e24131cdb49f17c77da to < 8e2036fb47a5b152d53eadbd35abf311bd34cc7faffected47a2b338fe63200d716d2e24131cdb49f17c77da to < bad289e42f512646a988f278f536d21547df73f1affected47a2b338fe63200d716d2e24131cdb49f17c77da to < 752b30e9d339008e5ce7eed412e9446078916129affected47a2b338fe63200d716d2e24131cdb49f17c77da to < 39c4ea72a40503e102ae07e6776005f96ca078a6affected47a2b338fe63200d716d2e24131cdb49f17c77da to < 5091e25ec503f7fc02723ca435226467b68caac7affected47a2b338fe63200d716d2e24131cdb49f17c77da to < c0d8df85db146d6275e226cb950023be69dd6c77affected47a2b338fe63200d716d2e24131cdb49f17c77da to < 3476c28c9addfa253f505e6bd87f1f5598b961d0affected
Linux Linux
Default version status: affected
4.13affected0 to < 4.13unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4617c9a856188674dddb0ca66979746d07688579 ↗
- https://git.kernel.org/stable/c/8e2036fb47a5b152d53eadbd35abf311bd34cc7f ↗
- https://git.kernel.org/stable/c/bad289e42f512646a988f278f536d21547df73f1 ↗
- https://git.kernel.org/stable/c/752b30e9d339008e5ce7eed412e9446078916129 ↗
- https://git.kernel.org/stable/c/39c4ea72a40503e102ae07e6776005f96ca078a6 ↗
- https://git.kernel.org/stable/c/5091e25ec503f7fc02723ca435226467b68caac7 ↗
- https://git.kernel.org/stable/c/c0d8df85db146d6275e226cb950023be69dd6c77 ↗
- https://git.kernel.org/stable/c/3476c28c9addfa253f505e6bd87f1f5598b961d0 ↗