Description
In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1659185fb4d0025835eb2058a141f0746c5cab00 to < 1be3211e6ac77adbb1eac01314d989d243b32c59affected1659185fb4d0025835eb2058a141f0746c5cab00 to < c42d316163f89cd23de2f3e24558177a8c29bad8affected1659185fb4d0025835eb2058a141f0746c5cab00 to < 8dca3c81344532a7f05edb3d12f31f3009410a90affected1659185fb4d0025835eb2058a141f0746c5cab00 to < 49ba5ed0129906e0362c2e4b5e21c89b2a41e115affected1659185fb4d0025835eb2058a141f0746c5cab00 to < 4468df5bcdef959fd96494e9968f323561a45f4caffected1659185fb4d0025835eb2058a141f0746c5cab00 to < e2ee0616260080376123997488b5cf8a3870b8d9affected1659185fb4d0025835eb2058a141f0746c5cab00 to < b36d32f30c3f1e58e3a5ae79d0f52836a316b36eaffected1659185fb4d0025835eb2058a141f0746c5cab00 to < 58eb1b3325edac42dc6df72c80962bd53a3c8ca7affected
Linux Linux
Default version status: affected
4.6affected0 to < 4.6unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59 ↗
- https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8 ↗
- https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90 ↗
- https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115 ↗
- https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c ↗
- https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9 ↗
- https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e ↗
- https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7 ↗