CVE-2025-21886

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix implicit ODP hang on parent deregistration

Fix the destroy_unused_implicit_child_mr() to prevent hanging during

parent deregistration as of below [1].

Upon entering destroy_unused_implicit_child_mr(), the reference count

for the implicit MR parent is incremented using:

refcount_inc_not_zero().

A corresponding decrement must be performed if

free_implicit_child_mr_work() is not called.

The code has been updated to properly manage the reference count that

was incremented.

[1]

INFO: task python3:2157 blocked for more than 120 seconds.

Not tainted 6.12.0-rc7+ #1633

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:python3 state:D stack:0 pid:2157 tgid:2157 ppid:1685 flags:0x00000000

Call Trace:

<TASK>

__schedule+0x420/0xd30

schedule+0x47/0x130

__mlx5_ib_dereg_mr+0x379/0x5d0 [mlx5_ib]

? __pfx_autoremove_wake_function+0x10/0x10

ib_dereg_mr_user+0x5f/0x120 [ib_core]

? lock_release+0xc6/0x280

destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs]

uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs]

uobj_destroy+0x3f/0x70 [ib_uverbs]

ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs]

? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs]

? lock_acquire+0xc1/0x2f0

? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs]

? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs]

? lock_release+0xc6/0x280

ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs]

? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs]

__x64_sys_ioctl+0x1b0/0xa70

? kmem_cache_free+0x221/0x400

do_syscall_64+0x6b/0x140

entry_SYSCALL_64_after_hwframe+0x76/0x7e

RIP: 0033:0x7f20f21f017b

RSP: 002b:00007ffcfc4a77c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010

RAX: ffffffffffffffda RBX: 00007ffcfc4a78d8 RCX: 00007f20f21f017b

RDX: 00007ffcfc4a78c0 RSI: 00000000c0181b01 RDI: 0000000000000003

RBP: 00007ffcfc4a78a0 R08: 000056147d125190 R09: 00007f20f1f14c60

R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffcfc4a7890

R13: 000000000000001c R14: 000056147d100fc0 R15: 00007f20e365c9d0

</TASK>