Linux vulnerability

What happened

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rn_unregister on failed accept When svc_rdma_accept() takes the errout path before rpcrdma_rn_register() has succeeded, the existing cleanup block calls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally. svcxprt_rdma is kzalloc'd, so on that path sc_rn.rn_index is 0 and sc_rn.rn_done is NULL; the unregister therefore xa_erase()s another caller's slot 0 and performs an unmatched kref_put() on the rpcrdma_device's rd_kref. The same errout also brackets the cleanup with svc_xprt_get()/ svc_xprt_put() around the kref_init() birth reference. The kref goes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the net/ns_tracker it pinned) is leaked on every failed accept. rpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc() and kref_get() have both succeeded, so rn_done == NULL is a natural "never registered" sentinel. Guard rpcrdma_rn_unregister() with an early return when rn_done is NULL, and clear rn_done before the matching xa_erase() so a repeated unregister is also a no-op. With that guard in place, the accept errout drops the kref_init() birth reference via svc_xprt_put(), which dispatches svc_rdma_free(). Teardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing IS_ERR/NULL guards in svc_rdma_free(); sc_rn is covered by the new rn_done sentinel; sc_cm_id is non-NULL on every errout path because svc_rdma_accept() dereferences it above the first goto errout. svc_xprt_free() drops the module reference associated with the freed transport, and svc_handle_xprt() drops its pre-acquired reference when ->xpo_accept() returns NULL. Take a replacement module reference before svc_xprt_put() so the two module_put()s remain balanced. The rn_done guard also covers svc_rdma_free()'s non-listener call to rpcrdma_rn_unregister() for transports whose register attempt failed or never ran.

Affected versions

Linux: cb3cba0ec372fa7c5f5f5c12990bef02e458ab86 through before 0335800071a6dfdf7d21d729b5e7d8fa98936211 (git); 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932 through before 5aabe070c00e5bdf4ab150fb5f72ad5f266d6241 (git); 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932 through before 45a444a17240f4fa2235f0dfd4a96fc80f1eb2c2 (git); 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932 through before 26190394c64c9429481fc88a4738f70bb92fb352 (git); d310955106c358c8e1ea682defd8e21af44a6cba (git); 6.12.35 through before 6.12.109 (semver); 6.15.4 through before 6.16 (semver); 6.16 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.