| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-53229: RDMA/rxe: Fix the qp flush warnings in req |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| RDMA/rxe: Fix the qp flush warnings in req |
| |
| When the qp is in error state, the status of WQEs in the queue should be |
| set to error. Or else the following will appear. |
| |
| [ 920.617269] WARNING: CPU: 1 PID: 21 at drivers/infiniband/sw/rxe/rxe_comp.c:756 rxe_completer+0x989/0xcc0 [rdma_rxe] |
| [ 920.617744] Modules linked in: rnbd_client(O) rtrs_client(O) rtrs_core(O) rdma_ucm rdma_cm iw_cm ib_cm crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel ib_uverbs ib_core loop brd null_blk ipv6 |
| [ 920.618516] CPU: 1 PID: 21 Comm: ksoftirqd/1 Tainted: G O 6.1.113-storage+ #65 |
| [ 920.618986] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 |
| [ 920.619396] RIP: 0010:rxe_completer+0x989/0xcc0 [rdma_rxe] |
| [ 920.619658] Code: 0f b6 84 24 3a 02 00 00 41 89 84 24 44 04 00 00 e9 2a f7 ff ff 39 ca bb 03 00 00 00 b8 0e 00 00 00 48 0f 45 d8 e9 15 f7 ff ff <0f> 0b e9 cb f8 ff ff 41 bf f5 ff ff ff e9 08 f8 ff ff 49 8d bc 24 |
| [ 920.620482] RSP: 0018:ffff97b7c00bbc38 EFLAGS: 00010246 |
| [ 920.620817] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000008 |
| [ 920.621183] RDX: ffff960dc396ebc0 RSI: 0000000000005400 RDI: ffff960dc4e2fbac |
| [ 920.621548] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffffac406450 |
| [ 920.621884] R10: ffffffffac4060c0 R11: 0000000000000001 R12: ffff960dc4e2f800 |
| [ 920.622254] R13: ffff960dc4e2f928 R14: ffff97b7c029c580 R15: 0000000000000000 |
| [ 920.622609] FS: 0000000000000000(0000) GS:ffff960ef7d00000(0000) knlGS:0000000000000000 |
| [ 920.622979] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [ 920.623245] CR2: 00007fa056965e90 CR3: 00000001107f1000 CR4: 00000000000006e0 |
| [ 920.623680] Call Trace: |
| [ 920.623815] <TASK> |
| [ 920.623933] ? __warn+0x79/0xc0 |
| [ 920.624116] ? rxe_completer+0x989/0xcc0 [rdma_rxe] |
| [ 920.624356] ? report_bug+0xfb/0x150 |
| [ 920.624594] ? handle_bug+0x3c/0x60 |
| [ 920.624796] ? exc_invalid_op+0x14/0x70 |
| [ 920.624976] ? asm_exc_invalid_op+0x16/0x20 |
| [ 920.625203] ? rxe_completer+0x989/0xcc0 [rdma_rxe] |
| [ 920.625474] ? rxe_completer+0x329/0xcc0 [rdma_rxe] |
| [ 920.625749] rxe_do_task+0x80/0x110 [rdma_rxe] |
| [ 920.626037] rxe_requester+0x625/0xde0 [rdma_rxe] |
| [ 920.626310] ? rxe_cq_post+0xe2/0x180 [rdma_rxe] |
| [ 920.626583] ? do_complete+0x18d/0x220 [rdma_rxe] |
| [ 920.626812] ? rxe_completer+0x1a3/0xcc0 [rdma_rxe] |
| [ 920.627050] rxe_do_task+0x80/0x110 [rdma_rxe] |
| [ 920.627285] tasklet_action_common.constprop.0+0xa4/0x120 |
| [ 920.627522] handle_softirqs+0xc2/0x250 |
| [ 920.627728] ? sort_range+0x20/0x20 |
| [ 920.627942] run_ksoftirqd+0x1f/0x30 |
| [ 920.628158] smpboot_thread_fn+0xc7/0x1b0 |
| [ 920.628334] kthread+0xd6/0x100 |
| [ 920.628504] ? kthread_complete_and_exit+0x20/0x20 |
| [ 920.628709] ret_from_fork+0x1f/0x30 |
| [ 920.628892] </TASK> |
| |
| The Linux kernel CVE team has assigned CVE-2024-53229 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.0 with commit ae720bdb703b295fed4ded28e14dd06a534a3012 and fixed in 6.1.127 with commit 9e95518eca5ccc0a2f5d99d7b8a142c73ce3f8d0 |
| Issue introduced in 6.0 with commit ae720bdb703b295fed4ded28e14dd06a534a3012 and fixed in 6.6.64 with commit 31978d5c5aef034d96fc53b4a9cb3c6e11dbb94d |
| Issue introduced in 6.0 with commit ae720bdb703b295fed4ded28e14dd06a534a3012 and fixed in 6.11.11 with commit e4f26fae6075f136616d12a369b0ef7f0cf16436 |
| Issue introduced in 6.0 with commit ae720bdb703b295fed4ded28e14dd06a534a3012 and fixed in 6.12.2 with commit cc341b5d761a8a16693fe406b8127e4378747f85 |
| Issue introduced in 6.0 with commit ae720bdb703b295fed4ded28e14dd06a534a3012 and fixed in 6.13 with commit ea4c990fa9e19ffef0648e40c566b94ba5ab31be |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-53229 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/infiniband/sw/rxe/rxe_req.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/9e95518eca5ccc0a2f5d99d7b8a142c73ce3f8d0 |
| https://git.kernel.org/stable/c/31978d5c5aef034d96fc53b4a9cb3c6e11dbb94d |
| https://git.kernel.org/stable/c/e4f26fae6075f136616d12a369b0ef7f0cf16436 |
| https://git.kernel.org/stable/c/cc341b5d761a8a16693fe406b8127e4378747f85 |
| https://git.kernel.org/stable/c/ea4c990fa9e19ffef0648e40c566b94ba5ab31be |
