High · published June 19, 2024
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Add a timeout to acquire the command queue semaphore
Prevent forced completion handling on an entry that has not yet been
assigned an index, causing an out of bounds access on idx = -22.
Instead of waiting indefinitely for the sem, blocking flow now waits for
index to be allocated or a sem acquisition timeout before beginning the
timer for FW completion.
Kernel log example:
mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.4.174, < 5.5 | 5.5 |
| linux/linux_kernel | ≥ 5.10.94, < 5.11 | 5.11 |
| linux/linux_kernel | ≥ 5.15.17, < 5.16 | 5.16 |
| linux/linux_kernel | ≥ 5.16.3, ≤ 6.1.93 | — |
| linux/linux_kernel | ≥ 6.2, ≤ 6.6.33 | — |
| linux/linux_kernel | ≥ 6.7, ≤ 6.8.12 | — |
| linux/linux_kernel | ≥ 6.9, ≤ 6.9.3 | — |