CVE-2023-54274 | THREATINT

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Add a check for valid 'mad_agent' pointer When unregistering MAD agent, srpt module has a non-null check for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). This check can pass if 'mad_agent' variable holds an error value. The 'mad_agent' can have an error value for a short window when srpt_add_one() and srpt_remove_one() is executed simultaneously. In srpt module, added a valid pointer check for 'sport->mad_agent' before unregistering MAD agent. This issue can hit when RoCE driver unregisters ib_device Stack Trace: ------------ BUG: kernel NULL pointer dereference, address: 000000000000004d PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020 Workqueue: bnxt_re bnxt_re_task [bnxt_re] RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40 Call Trace: ib_unregister_mad_agent+0x46/0x2f0 [ib_core] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready ? __schedule+0x20b/0x560 srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt] srpt_remove_one+0x20/0x150 [ib_srpt] remove_client_context+0x88/0xd0 [ib_core] bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex disable_device+0x8a/0x160 [ib_core] bond0: active interface up! ? kernfs_name_hash+0x12/0x80 (NULL device *): Bonding Info Received: rdev: 000000006c0b8247 __ib_unregister_device+0x42/0xb0 [ib_core] (NULL device *): Master: mode: 4 num_slaves:2 ib_unregister_device+0x22/0x30 [ib_core] (NULL device *): Slave: id: 105069936 name:p2p1 link:0 state:0 bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re] bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re]

PUBLISHED Reserved 2025-12-30 | Published 2025-12-30 | Updated 2025-12-30 | Assigner Linux

Product status

Default status

unaffected

a42d985bd5b234da8b61347a78dc3057bf7bb94d (git) before 8ec6acdb9b6a80eeb13e778dfedb5d72a88f14fe

affected

a42d985bd5b234da8b61347a78dc3057bf7bb94d (git) before 00cc21e32ea1b8ebbabf5d645da9378d986bf8ba

affected

a42d985bd5b234da8b61347a78dc3057bf7bb94d (git) before 4323aaedeba32076e652aad056afd7885bb96bb7

affected

a42d985bd5b234da8b61347a78dc3057bf7bb94d (git) before 5f6ef2a574b0e0e0ea46ed0022575442df9d0bf9

affected

a42d985bd5b234da8b61347a78dc3057bf7bb94d (git) before b713623bfef8cb1df9c769a3887fa10db63d1c54

affected

a42d985bd5b234da8b61347a78dc3057bf7bb94d (git) before eca5cd9474cd26d62f9756f536e2e656d3f62f3a

affected

Default status

affected

3.3

affected

Any version before 3.3

unaffected

5.10.180 (semver)

unaffected

5.15.111 (semver)

unaffected

6.1.28 (semver)

unaffected

6.2.15 (semver)

unaffected

6.3.2 (semver)

unaffected

6.4 (original_commit_for_fix)

unaffected

References

git.kernel.org/...c/8ec6acdb9b6a80eeb13e778dfedb5d72a88f14fe

git.kernel.org/...c/00cc21e32ea1b8ebbabf5d645da9378d986bf8ba

git.kernel.org/...c/4323aaedeba32076e652aad056afd7885bb96bb7

git.kernel.org/...c/5f6ef2a574b0e0e0ea46ed0022575442df9d0bf9

git.kernel.org/...c/b713623bfef8cb1df9c769a3887fa10db63d1c54

git.kernel.org/...c/eca5cd9474cd26d62f9756f536e2e656d3f62f3a

cve.org (CVE-2023-54274)

nvd.nist.gov (CVE-2023-54274)

Download JSON