CVE-2023-52851

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF<br /> <br /> In the unlikely event that workqueue allocation fails and returns NULL in<br /> mlx5_mkey_cache_init(), delete the call to<br /> mlx5r_umr_resource_cleanup() (which frees the QP) in<br /> mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double<br /> free of the same QP when __mlx5_ib_add() does its cleanup.<br /> <br /> Resolves a splat:<br /> <br /> Syzkaller reported a UAF in ib_destroy_qp_user<br /> <br /> workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR<br /> infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642):<br /> failed to create work queue<br /> infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642):<br /> mr cache init failed -12<br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)<br /> Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642<br /> <br /> Call Trace:<br /> <br /> kasan_report (mm/kasan/report.c:590)<br /> ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)<br /> mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)<br /> __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178)<br /> mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)<br /> ...<br /> <br /> <br /> Allocated by task 1642:<br /> __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026<br /> mm/slab_common.c:1039)<br /> create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720<br /> ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209)<br /> ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347)<br /> mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164)<br /> mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070)<br /> __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168)<br /> mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)<br /> ...<br /> <br /> Freed by task 1642:<br /> __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822)<br /> ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112)<br /> mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)<br /> mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076<br /> drivers/infiniband/hw/mlx5/main.c:4065)<br /> __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168)<br /> mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)<br /> ...