CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/counter: Fix numcounters leak on bindqp failure in allocandbind()
When rdmacounterbindqp() fails in allocandbind(), the error path jumps to errmode which frees the counter without decrementing portcounter->numcounters. The only place that decrements is rdmacounterfree(), which is unreachable since the counter was never successfully bound.
This leak accumulates across repeated failures, permanently preventing the port from switching to AUTO mode (-EBUSY in countersetmode()) and blocking the MANUAL→NONE auto-revert in rdmacounterfree(). When the mode was NONE before the call, the MANUAL mode set by countersetmode() also leaks since the revert logic is never reached.
Add an errbind label between the numcounters increment and the existing errmode label. It decrements numcounters and mirrors the MANUAL→NONE revert from rdmacounterfree(), ensuring the port state is fully restored on bind failure.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the leak?
A call to alloc_and_bind() must reach the point where it increments port_counter->num_counters and then have __rdma_counter_bind_qp() fail. Repeated bind failures accumulate the leaked counter count.
What is the operational impact of repeated failures?
The port can become permanently unable to switch to AUTO mode because __counter_set_mode() returns -EBUSY. The MANUAL-to-NONE automatic revert in rdma_counter_free() can also be blocked.
Can a failed bind leave the port mode changed?
Yes. If the port was in NONE mode before the call, the MANUAL mode selected during the operation can remain set after a bind failure because the error path does not reach the revert logic.
What does the fix restore on a bind failure?
The corrected error path decrements port_counter->num_counters and applies the same MANUAL-to-NONE revert used by rdma_counter_free(). This restores the port counter state after the failed bind.