CVE-2024-47694: IB/mlx5: Fix UMR pd cleanup on error flow of driver init
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix UMR pd cleanup on error flow of driver init
The cited commit moves the pd allocation from function mlx5rumrresourcecleanup() to a new function mlx5rumrcleanup(). So the fix in commit [1] is broken. In error flow, will hit panic [2].
Fix it by checking pd pointer to avoid panic if it is NULL;
[1] RDMA/mlx5: Fix UMR cleanup on error flow of driver init [2] [ 347.567063] infiniband mlx50: Couldn't register device with driver model [ 347.591382] BUG: kernel NULL pointer dereference, address: 0000000000000020 [ 347.593438] #PF: supervisor read access in kernel mode [ 347.595176] #PF: errorcode(0x0000) - not-present page [ 347.596962] PGD 0 P4D 0 [ 347.601361] RIP: 0010:ibdeallocpduser+0x12/0xc0 [ibcore] [ 347.604171] RSP: 0018:ffff888106293b10 EFLAGS: 00010282 [ 347.604834] RAX: 0000000000000000 RBX: 000000000000000e RCX: 0000000000000000 [ 347.605672] RDX: ffff888106293ad0 RSI: 0000000000000000 RDI: 0000000000000000 [ 347.606529] RBP: 0000000000000000 R08: ffff888106293ae0 R09: ffff888106293ae0 [ 347.607379] R10: 0000000000000a06 R11: 0000000000000000 R12: 0000000000000000 [ 347.608224] R13: ffffffffa0704dc0 R14: 0000000000000001 R15: 0000000000000001 [ 347.609067] FS: 00007fdc720cd9c0(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 [ 347.610094] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 347.610727] CR2: 0000000000000020 CR3: 0000000103012003 CR4: 0000000000370eb0 [ 347.611421] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 347.612113] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 347.612804] Call Trace: [ 347.613130] <TASK> [ 347.613417] ? die+0x20/0x60 [ 347.613793] ? pagefaultoops+0x150/0x3e0 [ 347.614243] ? freemsg+0x68/0x80 [mlx5core] [ 347.614840] ? cmdexec+0x48f/0x11d0 [mlx5core] [ 347.615359] ? excpagefault+0x74/0x130 [ 347.615808] ? asmexcpagefault+0x22/0x30 [ 347.616273] ? ibdeallocpduser+0x12/0xc0 [ibcore] [ 347.616801] mlx5rumrcleanup+0x23/0x90 [mlx5ib] [ 347.617365] mlx5ibstagepreibregumrcleanup+0x36/0x40 [mlx5ib] [ 347.618025] mlx5ibadd+0x96/0xd0 [mlx5ib] [ 347.618539] mlx5rprobe+0xe9/0x310 [mlx5ib] [ 347.619032] ? kernfsaddone+0x107/0x150 [ 347.619478] ? mlx5ibadd+0xd0/0xd0 [mlx5ib] [ 347.619984] auxiliarybusprobe+0x3e/0x90 [ 347.620448] reallyprobe+0xc5/0x3a0 [ 347.620857] driverprobedevice+0x80/0x160 [ 347.621325] driverprobedevice+0x1e/0x90 [ 347.621770] driverattach+0xec/0x1c0 [ 347.622213] ? deviceattachdriver+0x100/0x100 [ 347.622724] busforeachdev+0x71/0xc0 [ 347.623151] busadddriver+0xed/0x240 [ 347.623570] driverregister+0x58/0x100 [ 347.623998] auxiliarydriverregister+0x6a/0xc0 [ 347.624499] ? driverregister+0xae/0x100 [ 347.624940] ? 0xffffffffa0893000 [ 347.625329] mlx5ibinit+0x16a/0x1e0 [mlx5ib] [ 347.625845] dooneinitcall+0x4a/0x2a0 [ 347.626273] ? gcovevent+0x2e2/0x3a0 [ 347.626706] doinitmodule+0x8a/0x260 [ 347.627126] initmodulefromfile+0x8b/0xd0 [ 347.627596] x64sysfinitmodule+0x1ca/0x2f0 [ 347.628089] dosyscall64+0x4c/0x100
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47694?
CVE-2024-47694 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-47694?
To fix CVE-2024-47694, update to the recommended kernel versions provided in your Linux distribution.
Which versions of the Linux kernel are affected by CVE-2024-47694?
CVE-2024-47694 affects Linux kernel versions between 6.11 and 6.11.2 inclusive.
What components are impacted by CVE-2024-47694?
CVE-2024-47694 impacts the IB/mlx5 driver in the Linux kernel.
Are there any specific packages affected by CVE-2024-47694?
Yes, specific Debian packages such as linux versions 5.10.223-1 and 6.12.15-1 are affected by CVE-2024-47694.