CVE-2023-52851

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF

In the unlikely event that workqueue allocation fails and returns NULL in

mlx5_mkey_cache_init(), delete the call to

mlx5r_umr_resource_cleanup() (which frees the QP) in

mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double

free of the same QP when __mlx5_ib_add() does its cleanup.

Resolves a splat:

Syzkaller reported a UAF in ib_destroy_qp_user

workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR

infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642):

failed to create work queue

infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642):

mr cache init failed -12

==================================================================

BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)

Read of size 8 at addr ffff88810da310a8 b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References