CVE-2024-35959

When mlx5eprivinit() fails, the cleanup flow calls mlx5eselqcleanup which calls mlx5eselqapply() that assures that the priv->state_lock is held using lockdepisheld().

Acquire the statelock in mlx5eselq_cleanup().

Kernel log:

WARNING: suspicious RCU usage

6.8.0-rc3netnext_841a9b5 #1 Not tainted

drivers/net/ethernet/mellanox/mlx5/core/en/selq.c:124 suspicious rcudereferenceprotected() usage!

other info that might help us debug this:

rcuscheduleractive = 2, debuglocks = 1 2 locks held by systemd-modules/293: #0: ffffffffa05067b0 (devicesrwsem){++++}-{3:3}, at: ibregisterclient+0x109/0x1b0 [ibcore] #1: ffff8881096c65c0 (&device->clientdatarwsem){++++}-{3:3}, at: addclientcontext+0x104/0x1c0 [ibcore]

stack backtrace: CPU: 4 PID: 293 Comm: systemd-modules Not tainted 6.8.0-rc3netnext841a9b5 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x8a/0xa0 lockdeprcususpicious+0x154/0x1a0 mlx5eselqapply+0x94/0xa0 [mlx5core] mlx5eselqcleanup+0x3a/0x60 [mlx5core] mlx5eprivinit+0x2be/0x2f0 [mlx5core] mlx5rdmasetuprn+0x7c/0x1a0 [mlx5core] rdmainitnetdev+0x4e/0x80 [ibcore] ? mlx5rdmanetdevfree+0x70/0x70 [mlx5core] ipoibintfinit+0x64/0x550 [ibipoib] ipoibintfalloc+0x4e/0xc0 [ibipoib] ipoibaddone+0xb0/0x360 [ibipoib] addclientcontext+0x112/0x1c0 [ibcore] ibregisterclient+0x166/0x1b0 [ibcore] ? 0xffffffffa0573000 ipoibinitmodule+0xeb/0x1a0 [ibipoib] dooneinitcall+0x61/0x250 doinitmodule+0x8a/0x270 initmodulefromfile+0x8b/0xd0 idempotentinitmodule+0x17d/0x230 _x64sysfinitmodule+0x61/0xb0 dosyscall64+0x71/0x140 entrySYSCALL64afterhwframe+0x46/0x4e </TASK>

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8bf30be75069d6080659de9a28565c048f6cef9b

Fixed

ad26f26abd353113dea4e8d5ebadccdab9b61e76

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8bf30be75069d6080659de9a28565c048f6cef9b

Fixed

f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8bf30be75069d6080659de9a28565c048f6cef9b

Fixed

6bd77865fda662913dcb5722a66a773840370aa7

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8bf30be75069d6080659de9a28565c048f6cef9b

Fixed

ecb829459a841198e142f72fadab56424ae96519

Affected versions

v5.*

v5.17

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.45

v6.1.46

v6.1.47

v6.1.48

v6.1.49

v6.1.5

v6.1.50

v6.1.51

v6.1.52

v6.1.53

v6.1.54

v6.1.55

v6.1.56

v6.1.57

v6.1.58

v6.1.59

v6.1.6

v6.1.60

v6.1.61

v6.1.62

v6.1.63

v6.1.64

v6.1.65

v6.1.66

v6.1.67

v6.1.68

v6.1.69

v6.1.7

v6.1.70

v6.1.71

v6.1.72

v6.1.73

v6.1.74

v6.1.75

v6.1.76

v6.1.77

v6.1.78

v6.1.79

v6.1.8

v6.1.80

v6.1.81

v6.1.82

v6.1.83

v6.1.84

v6.1.85

v6.1.86

v6.1.9

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.6.1

v6.6.10

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.15

v6.6.16

v6.6.17

v6.6.18

v6.6.19

v6.6.2

v6.6.20

v6.6.21

v6.6.22

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.3

v6.6.4

v6.6.5

v6.6.6

v6.6.7

v6.6.8

v6.6.9

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.8.1

v6.8.2

v6.8.3

v6.8.4

v6.8.5

v6.8.6

v6.9-rc1

v6.9-rc2

Database specific

vanir_signatures

[
    {
        "digest": {
            "length": 239.0,
            "function_hash": "292616793415687634407419691715450301594"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c",
            "function": "mlx5e_selq_cleanup"
        },
        "signature_type": "Function",
        "id": "CVE-2024-35959-1ffbf547",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd77865fda662913dcb5722a66a773840370aa7"
    },
    {
        "digest": {
            "line_hashes": [
                "52554351596092881107869062858269276731",
                "2406391831776979000132007011946692580",
                "327324637086270967207082067380635459433",
                "329349948213340143511571975744239048959",
                "108881841786055895489761450133880577352",
                "231612206605458081137022376296728381113"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
        },
        "signature_type": "Line",
        "id": "CVE-2024-35959-2e03c527",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb829459a841198e142f72fadab56424ae96519"
    },
    {
        "digest": {
            "line_hashes": [
                "152234894320264847456355845111544364492",
                "133788223433299995662907074235885268528",
                "98714480633845972928186898473917471131",
                "114453739963952488576618835425881326553",
                "304026468190110126277361455882859031363",
                "144351542941729185253823494200936657275",
                "250302980114763658528985294415886510915",
                "291520485558025266118905593391490182591"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c"
        },
        "signature_type": "Line",
        "id": "CVE-2024-35959-3402951d",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3"
    },
    {
        "digest": {
            "length": 651.0,
            "function_hash": "120579572620599068544742021279759338585"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
            "function": "mlx5e_priv_cleanup"
        },
        "signature_type": "Function",
        "id": "CVE-2024-35959-7e74492d",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd77865fda662913dcb5722a66a773840370aa7"
    },
    {
        "digest": {
            "line_hashes": [
                "52554351596092881107869062858269276731",
                "2406391831776979000132007011946692580",
                "327324637086270967207082067380635459433",
                "329349948213340143511571975744239048959",
                "108881841786055895489761450133880577352",
                "231612206605458081137022376296728381113"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
        },
        "signature_type": "Line",
        "id": "CVE-2024-35959-89f7c25b",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd77865fda662913dcb5722a66a773840370aa7"
    },
    {
        "digest": {
            "length": 239.0,
            "function_hash": "292616793415687634407419691715450301594"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c",
            "function": "mlx5e_selq_cleanup"
        },
        "signature_type": "Function",
        "id": "CVE-2024-35959-8a49ce39",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3"
    },
    {
        "digest": {
            "length": 239.0,
            "function_hash": "292616793415687634407419691715450301594"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c",
            "function": "mlx5e_selq_cleanup"
        },
        "signature_type": "Function",
        "id": "CVE-2024-35959-980c1af7",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb829459a841198e142f72fadab56424ae96519"
    },
    {
        "digest": {
            "line_hashes": [
                "52554351596092881107869062858269276731",
                "2406391831776979000132007011946692580",
                "327324637086270967207082067380635459433",
                "329349948213340143511571975744239048959",
                "108881841786055895489761450133880577352",
                "231612206605458081137022376296728381113"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
        },
        "signature_type": "Line",
        "id": "CVE-2024-35959-a7bc0112",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3"
    },
    {
        "digest": {
            "line_hashes": [
                "152234894320264847456355845111544364492",
                "133788223433299995662907074235885268528",
                "98714480633845972928186898473917471131",
                "114453739963952488576618835425881326553",
                "304026468190110126277361455882859031363",
                "144351542941729185253823494200936657275",
                "250302980114763658528985294415886510915",
                "291520485558025266118905593391490182591"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c"
        },
        "signature_type": "Line",
        "id": "CVE-2024-35959-c077c895",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd77865fda662913dcb5722a66a773840370aa7"
    },
    {
        "digest": {
            "length": 651.0,
            "function_hash": "120579572620599068544742021279759338585"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
            "function": "mlx5e_priv_cleanup"
        },
        "signature_type": "Function",
        "id": "CVE-2024-35959-d5a7fea4",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb829459a841198e142f72fadab56424ae96519"
    },
    {
        "digest": {
            "line_hashes": [
                "152234894320264847456355845111544364492",
                "133788223433299995662907074235885268528",
                "98714480633845972928186898473917471131",
                "114453739963952488576618835425881326553",
                "304026468190110126277361455882859031363",
                "144351542941729185253823494200936657275",
                "250302980114763658528985294415886510915",
                "291520485558025266118905593391490182591"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c"
        },
        "signature_type": "Line",
        "id": "CVE-2024-35959-e6f6ddf6",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb829459a841198e142f72fadab56424ae96519"
    },
    {
        "digest": {
            "length": 651.0,
            "function_hash": "120579572620599068544742021279759338585"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
            "function": "mlx5e_priv_cleanup"
        },
        "signature_type": "Function",
        "id": "CVE-2024-35959-fdd5a72a",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3"
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.18.0

Fixed

6.1.87

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.28

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.8.7