Andrew Lukoshko
018222497a
Add the RHEL 687.14.1..687.15.1 backports (1270-1284) from centos-stream-9 and
upstream stable, on top of 687.13.1. The dpll/zl3073x and ice RSS-queue series are
consolidated (they carry RHEL kABI wrapping and RHEL-only files). The mlx5 kabi
removal (RHEL-181822) is applied via updated Module.kabi_{aarch64,s390x,x86_64}.
Bump pkgrelease and specrelease to 687.15.1.
38 lines
1.2 KiB
Diff
38 lines
1.2 KiB
Diff
Subject: [PATCH] RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
|
|
# AlmaLinux: reconstructed base->final
|
|
|
|
diff --git a/drivers/net/ethernet/mellanox/mlx4/srq.c b/drivers/net/ethernet/mellanox/mlx4/srq.c
|
|
index dd890f5..b21eae5 100644
|
|
--- a/drivers/net/ethernet/mellanox/mlx4/srq.c
|
|
+++ b/drivers/net/ethernet/mellanox/mlx4/srq.c
|
|
@@ -44,13 +44,14 @@ void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type)
|
|
{
|
|
struct mlx4_srq_table *srq_table = &mlx4_priv(dev)->srq_table;
|
|
struct mlx4_srq *srq;
|
|
+ unsigned long flags;
|
|
|
|
- rcu_read_lock();
|
|
+ spin_lock_irqsave(&srq_table->lock, flags);
|
|
srq = radix_tree_lookup(&srq_table->tree, srqn & (dev->caps.num_srqs - 1));
|
|
- rcu_read_unlock();
|
|
- if (srq)
|
|
- refcount_inc(&srq->refcount);
|
|
- else {
|
|
+ if (!srq || !refcount_inc_not_zero(&srq->refcount))
|
|
+ srq = NULL;
|
|
+ spin_unlock_irqrestore(&srq_table->lock, flags);
|
|
+ if (!srq) {
|
|
mlx4_warn(dev, "Async event for bogus SRQ %08x\n", srqn);
|
|
return;
|
|
}
|
|
@@ -203,8 +204,8 @@ int mlx4_srq_alloc(struct mlx4_dev *dev, u32 pdn, u32 cqn, u16 xrcd,
|
|
if (err)
|
|
goto err_radix;
|
|
|
|
- refcount_set(&srq->refcount, 1);
|
|
init_completion(&srq->free);
|
|
+ atomic_set_release(&srq->refcount.refs, 1);
|
|
|
|
return 0;
|
|
|