CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
This patch addresses a race condition for an ODP MR that can result in a CQE with an error on the UMR QP.
During the mlx5ibderegmr() flow, the following sequence of calls occurs:
mlx5revokemr() mlx5rumrrevokemr() mlx5rumrpostsendwait()
At this point, the lkey is freed from the hardware's perspective.
However, concurrently, mlx5ibinvalidaterange() might be triggered by another task attempting to invalidate a range for the same freed lkey.
This task will: - Acquire the umemodp->umemmutex lock. - Call mlx5rumrupdatexlt() on the UMR QP. - Since the lkey has already been freed, this can lead to a CQE error, causing the UMR QP to enter an error state [1].
To resolve this race condition, the umemodp->umemmutex lock is now also acquired as part of the mlx5revokemr() scope. Upon successful revoke, we set umemodp->private which points to that MR to NULL, preventing any further invalidation attempts on its lkey.
[1] From dmesg:
infiniband rocep8s0f0: dumpcqe:277:(pid 0): WC error: 6, Message: memory bind operation error cqedump: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqedump: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqedump: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqedump: 00000030: 00 00 00 00 08 00 78 06 25 00 11 b9 00 0e dd d2
WARNING: CPU: 15 PID: 1506 at drivers/infiniband/hw/mlx5/umr.c:394 mlx5rumrpostsendwait+0x15a/0x2b0 [mlx5ib] Modules linked in: ip6tablemangle ip6tablenatip6tablefilter ip6tables iptablemangle xtconntrack xtMASQUERADE nfconntracknetlink nfnetlink xtaddrtype iptablenat nfnat brnetfilter rpcsecgsskrb5 authrpcgss oidregistry overlay rpcrdma rdmaucm ibiser libiscsi scsitransportiscsi rdmacm iwcm ibumad ibipoib ibcm mlx5ib ibuverbs ibcore fuse mlx5core CPU: 15 UID: 0 PID: 1506 Comm: ibvrcpingpong Not tainted 6.12.0-rc7+ #1626 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5rumrpostsendwait+0x15a/0x2b0 [mlx5ib] [..] Call Trace: <TASK> mlx5rumrupdatexlt+0x23c/0x3e0 [mlx5ib] mlx5ibinvalidaterange+0x2e1/0x330 [mlx5ib] mmunotifierinvalidaterangestart+0x1e1/0x240 zappagerangesingle+0xf1/0x1a0 madvisevmabehavior+0x677/0x6e0 domadvise+0x1a2/0x4b0 x64sysmadvise+0x25/0x30 dosyscall64+0x6b/0x140 entrySYSCALL64afterhwframe+0x76/0x7e
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the umem_odp->umem_mutex lock is acquired as part of the mlx5_revoke_mr() / mlx5r_umr_post_send_wait() flow so mlx5r_umr_update_xlt() on the UMR QP cannot race with concurrent mlx5_ib_invalidate_range() for the freed lkey.
Linux kernel RDMA (mlx5_ib / mlx5_core) umem_odp->umem_mutex lock (use during mlx5r_umr_update_xlt() / mlx5_revoke_mr() for ODP MR race) = acquire
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21732?
CVE-2025-21732 is classified as a medium severity vulnerability due to the potential race condition affecting memory registration.
How do I fix CVE-2025-21732?
To fix CVE-2025-21732, update to the latest stable version of the Linux kernel that includes the patch addressing this vulnerability.
What does CVE-2025-21732 affect?
CVE-2025-21732 affects the RDMA functionality of the Linux kernel, specifically related to memory registration.
What should I do if I'm running an affected version of the Linux kernel?
If you're running an affected version of the Linux kernel, it's crucial to apply the security patch or upgrade to a secure version as soon as possible.
Is there a potential impact from CVE-2025-21732?
Yes, CVE-2025-21732 may lead to errors in completion queue entries, which could affect RDMA operations.