CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix UMR hang in LAG error state unload
During firmware reset in LAG mode, a race condition causes the driver to hang indefinitely while waiting for UMR completion during device unload. See [1].
In LAG mode the bond device is only registered on the master, so it never sees syserror events from the slave. During firmware reset this causes UMR waits to hang forever on unload as the slave is dead but the master hasn't entered error state yet, so UMR posts succeed but completions never arrive.
Fix this by adding a syserror notifier that gets registered before MLX5IBSTAGEIBREG and stays alive until after ibunregisterdevice(). This ensures error events reach the bond device throughout teardown.
[1] Call Trace: schedule+0x2bd/0x760 schedule+0x37/0xa0 schedulepreemptdisabled+0xa/0x10 mutexlock.isra.6+0x2b5/0x4a0 mlx5ibderegmr+0x606/0x870 [mlx5ib] ? xaerase+0x4a/0xa0 ? condresched+0x15/0x30 ? waitforcompletion+0x31/0x100 ibderegmruser+0x48/0xc0 [ibcore] ? rdmacgunchargehierarchy+0xa0/0x100 destroyhwidruobject+0x20/0x50 [ibuverbs] uverbsdestroyuobject+0x37/0x150 [ibuverbs] uverbscleanupufile+0xda/0x140 [ibuverbs] uverbsdestroyufilehw+0x3a/0xf0 [ibuverbs] ibuverbsremoveone+0xc3/0x140 [ibuverbs] removeclientcontext+0x8b/0xd0 [ibcore] disabledevice+0x8c/0x130 [ibcore] ibunregisterdevice+0x10d/0x180 [ibcore] ibunregisterdevice+0x21/0x30 [ibcore] mlx5ibremove+0x1e4/0x1f0 [mlx5ib] auxiliarybusremove+0x1e/0x30 devicereleasedriverinternal+0x103/0x1f0 busremovedevice+0xf7/0x170 devicedel+0x181/0x410 mlx5rescandriverslocked.part.10+0xa9/0x1d0 [mlx5core] mlx5disablelag+0x253/0x260 [mlx5core] mlx5lagdisablechange+0x89/0xc0 [mlx5core] mlx5eswitchdisable+0x67/0xa0 [mlx5core] mlx5unload+0x15/0xd0 [mlx5core] mlx5unloadone+0x71/0xc0 [mlx5core] mlx5syncresetreloadwork+0x83/0x100 [mlx5core] processonework+0x1a7/0x360 workerthread+0x30/0x390 ? createworker+0x1a0/0x1a0 kthread+0x116/0x130 ? kthreadflushworkfn+0x10/0x10 retfromfork+0x22/0x40
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a sys_error notifier in the mlx5 driver that is registered before MLX5_IB_STAGE_IB_REG and is not unregistered until after ib_unregister_device(), so error events reach the bond device throughout teardown and prevent UMR waits from hanging during LAG-mode firmware reset.
RDMA/mlx5 (mlx5_ib/mlx5_core) sys_error_notifier registration timing = register before MLX5_IB_STAGE_IB_REG and remain registered until after ib_unregister_device()