CVE-2025-38373: IB/mlx5: Fix potential deadlock in MR deregistration
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix potential deadlock in MR deregistration
The issue arises when kzalloc() is invoked while holding umemmutex or any other lock acquired under umemmutex. This is problematic because kzalloc() can trigger fsreclaimaqcuire(), which may, in turn, invoke mmunotifierinvalidaterangestart(). This function can lead to mlx5ibinvalidaterange(), which attempts to acquire umemmutex again, resulting in a deadlock.
The problematic flow: CPU0 | CPU1 ---------------------------------------|------------------------------------------------ mlx5ibderegmr() | → revokemr() | → mutexlock(&umemodp->umemmutex) | | mlx5mkeycacheinit() | → mutexlock(&dev->cache.rblock) | → mlx5rcachecreateentlocked() | → kzalloc(GFPKERNEL) | → fsreclaim() | → mmunotifierinvalidaterangestart() | → mlx5ibinvalidaterange() | → mutexlock(&umemodp->umemmutex) → cacheentfindandstore() | → mutexlock(&dev->cache.rblock) |
Additionally, when kzalloc() is called from within cacheentfindandstore(), we encounter the same deadlock due to re-acquisition of umemmutex.
Solve by releasing umemmutex in deregmr() after umrrevokemr() and before acquiring rblock. This ensures that we don't hold umemmutex while performing memory allocations that could trigger the reclaim path.
This change prevents the deadlock by ensuring proper lock ordering and avoiding holding locks during memory allocation operations that could trigger the reclaim path.
The following lockdep warning demonstrates the deadlock:
python3/20557 is trying to acquire lock: ffff888387542128 (&umemodp->umemmutex){+.+.}-{4:4}, at: mlx5ibinvalidaterange+0x5b/0x550 [mlx5ib]
but task is already holding lock: ffffffff82f6b840 (mmunotifierinvalidaterangestart){+.+.}-{0:0}, at: unmapvmas+0x7b/0x1a0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (mmunotifierinvalidaterangestart){+.+.}-{0:0}: fsreclaimacquire+0x60/0xd0 memcgroupcssalloc+0x6f/0x9b0 cgroupinitsubsys+0xa4/0x240 cgroupinit+0x1c8/0x510 startkernel+0x747/0x760 x8664startreservations+0x25/0x30 x8664startkernel+0x73/0x80 commonstartup64+0x129/0x138
-> #2 (fsreclaim){+.+.}-{0:0}: fsreclaimacquire+0x91/0xd0 kmalloccachenoprof+0x4d/0x4c0 mlx5rcachecreateentlocked+0x75/0x620 [mlx5ib] mlx5mkeycacheinit+0x186/0x360 [mlx5ib] mlx5ibstagepostibregumrinit+0x3c/0x60 [mlx5ib] mlx5ibadd+0x4b/0x190 [mlx5ib] mlx5rprobe+0xd9/0x320 [mlx5ib] auxiliarybusprobe+0x42/0x70 reallyprobe+0xdb/0x360 driverprobedevice+0x8f/0x130 driverprobedevice+0x1f/0xb0 driverattach+0xd4/0x1f0 busforeachdev+0x79/0xd0 busadddriver+0xf0/0x200 driverregister+0x6e/0xc0 auxiliarydriverregister+0x6a/0xc0 dooneinitcall+0x5e/0x390 doinitmodule+0x88/0x240 initmodulefromfile+0x85/0xc0 idempotentinitmodule+0x104/0x300 x64sysfinitmodule+0x68/0xc0 dosyscall64+0x6d/0x140 entrySYSCALL64afterhwframe+0x4b/0x53
-> #1 (&dev->cache.rblock){+.+.}-{4:4}: mutexlock+0x98/0xf10 mlx5ibderegmr+0x6f2/0x890 [mlx5ib] mlx5ibderegmr+0x21/0x110 [mlx5ib] ibderegmruser+0x85/0x1f0 [ibcore] ---truncated---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.37-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.37 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.15.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.49~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1051.57~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.53~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1047.50~22.04.2 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1044.44~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.49~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1043.44~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1041.42~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-100.100 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49 - Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1046.52 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1046.53 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-azure-nvidia-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1047.50 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1018.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1043.48 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1030.33 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1044.44 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-100.100.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1046.49 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1020.20 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1043.44 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1047.51 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-34.34.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1023.24 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1016.20 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2037.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1041.42 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.52+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-100.100+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1047.50+fips1 - Compensating control
In the mlx5_ib driver, release umem_mutex in dereg_mr() after umr_revoke_mr() and before acquiring rb_lock, so memory allocations that may trigger the reclaim path do not occur while umem_mutex is held.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38373?
CVE-2025-38373 has a medium severity rating due to potential deadlocks in memory deregistration.
How do I fix CVE-2025-38373?
To fix CVE-2025-38373, ensure you are using the latest patched version of the Linux Kernel that addresses this specific vulnerability.
What impact does CVE-2025-38373 have on systems?
CVE-2025-38373 can lead to system instability or crashes caused by deadlocks during memory deregistration.
Which versions of the Linux Kernel are affected by CVE-2025-38373?
CVE-2025-38373 potentially affects various versions of the Linux Kernel where the umem_mutex lock is held.
What is the root cause of CVE-2025-38373?
The root cause of CVE-2025-38373 is the invocation of kzalloc() while holding a mutex, which can result in a deadlock.