CVE-2023-54302
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP completion stats CQP completion statistics is read lockesly in irdma_wait_event and irdma_check_cqp_progress while it can be updated in the completion thread irdma_sc_ccq_get_cqe_info on another CPU as KCSAN reports. Make completion statistics an atomic variable to reflect coherent updates to it. This will also avoid load/store tearing logic bug potentially possible by compiler optimizations. [77346.170861] BUG: KCSAN: data-race in irdma_handle_cqp_op [irdma] / irdma_sc_ccq_get_cqe_info [irdma] [77346.171383] write to 0xffff8a3250b108e0 of 8 bytes by task 9544 on cpu 4: [77346.171483] irdma_sc_ccq_get_cqe_info+0x27a/0x370 [irdma] [77346.171658] irdma_cqp_ce_handler+0x164/0x270 [irdma] [77346.171835] cqp_compl_worker+0x1b/0x20 [irdma] [77346.172009] process_one_work+0x4d1/0xa40 [77346.172024] worker_thread+0x319/0x700 [77346.172037] kthread+0x180/0x1b0 [77346.172054] ret_from_fork+0x22/0x30 [77346.172136] read to 0xffff8a3250b108e0 of 8 bytes by task 9838 on cpu 2: [77346.172234] irdma_handle_cqp_op+0xf4/0x4b0 [irdma] [77346.172413] irdma_cqp_aeq_cmd+0x75/0xa0 [irdma] [77346.172592] irdma_create_aeq+0x390/0x45a [irdma] [77346.172769] irdma_rt_init_hw.cold+0x212/0x85d [irdma] [77346.172944] irdma_probe+0x54f/0x620 [irdma] [77346.173122] auxiliary_bus_probe+0x66/0xa0 [77346.173137] really_probe+0x140/0x540 [77346.173154] __driver_probe_device+0xc7/0x220 [77346.173173] driver_probe_device+0x5f/0x140 [77346.173190] __driver_attach+0xf0/0x2c0 [77346.173208] bus_for_each_dev+0xa8/0xf0 [77346.173225] driver_attach+0x29/0x30 [77346.173240] bus_add_driver+0x29c/0x2f0 [77346.173255] driver_register+0x10f/0x1a0 [77346.173272] __auxiliary_driver_register+0xbc/0x140 [77346.173287] irdma_init_module+0x55/0x1000 [irdma] [77346.173460] do_one_initcall+0x7d/0x410 [77346.173475] do_init_module+0x81/0x2c0 [77346.173491] load_module+0x1232/0x12c0 [77346.173506] __do_sys_finit_module+0x101/0x180 [77346.173522] __x64_sys_finit_module+0x3c/0x50 [77346.173538] do_syscall_64+0x39/0x90 [77346.173553] entry_SYSCALL_64_after_hwframe+0x63/0xcd [77346.173634] value changed: 0x0000000000000094 -> 0x0000000000000095
How to fix
- Linux Linuxbf0f9f65b7fe36ea9d2e23263dcefc90255d7b1f, 4e1a5842a359ee18d5a9e75097d7cf4d93e233bb, 2623ca92cd8f9668edabe9e4f4a3cf77fd7115f2, f2c3037811381f9149243828c7eb9a1631df9f9c or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 915cc7ac0f8e2a23675ee896e87f17c7d3c47089 ≤ v < bf0f9f65b7fe36ea9d2e23263dcefc90255d7b1f, 915cc7ac0f8e2a23675ee896e87f17c7d3c47089 ≤ v < 4e1a5842a359ee18d5a9e75097d7cf4d93e233bb, 915cc7ac0f8e2a23675ee896e87f17c7d3c47089 ≤ v < 2623ca92cd8f9668edabe9e4f4a3cf77fd7115f2, 915cc7ac0f8e2a23675ee896e87f17c7d3c47089 ≤ v < f2c3037811381f9149243828c7eb9a1631df9f9c, 5.14 | bf0f9f65b7fe36ea9d2e23263dcefc90255d7b1f, 4e1a5842a359ee18d5a9e75097d7cf4d93e233bb, 2623ca92cd8f9668edabe9e4f4a3cf77fd7115f2, f2c3037811381f9149243828c7eb9a1631df9f9c |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.