CVE-2024-50147

net/mlx5: Fix command bitmask initialization

Medium · published November 7, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix command bitmask initialization

Command bitmask have a dedicated bit for MANAGE_PAGES command, this bit

isn't Initialize during command bitmask Initialization, only during

MANAGE_PAGES.

In addition, mlx5_cmd_trigger_completions() is trying to trigger

completion for MANAGE_PAGES command as well.

Hence, in case health error occurred before any MANAGE_PAGES command

have been invoke (for example, during mlx5_enable_hca()),

mlx5_cmd_trigger_completions() will try to trigger completion for

MANAGE_PAGES command, which will result in null-ptr-deref error.[1]

Fix it by Initialize command bitmask correctly.

While at it, re-write the code for better understanding.

[1]

BUG: KASAN: null-ptr-deref in mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core]

Write of size 4 at addr 0000000000000214 by task kworker/u96:2/12078

CPU: 10 PID: 12078 Comm: kworker/u96:2 Not tainted 6.9.0-rc2_for_upstream_debug_2024_04_07_19_01 #1

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014

Workqueue: mlx5_health0000:08:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]

Call Trace:

<TASK>

dump_stack_lvl+0x7e/0xc0

kasan_report+0xb9/0xf0

kasan_check_range+0xec/0x190

mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core]

mlx5_cmd_flush+0x94/0x240 [mlx5_core]

enter_error_state+0x6c/0xd0 [mlx5_core]

mlx5_fw_fatal_reporter_err_work+0xf3/0x480 [mlx5_core]

process_one_work+0x787/0x1490

? lockdep_hardirqs_on_prepare+0x400/0x400

? pwq_dec_nr_in_flight+0xda0/0xda0

? assign_work+0x168/0x240

worker_thread+0x586/0xd30

? rescuer_thread+0xae0/0xae0

kthread+0x2df/0x3b0

? kthread_complete_and_exit+0x20/0x20

ret_from_fork+0x2d/0x70

? kthread_complete_and_exit+0x20/0x20

ret_from_fork_asm+0x11/0x20

</TASK>

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Published
2024-11-07T09:31Z
EPSS history
Timeline
  • 07 NOV 09:31Z
    net/mlx5: Fix command bitmask initialization
    cvelistv5