In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet-rdma: fix response resource leak on queue teardown<\/p>\n
When an nvme target with rdma transport is removed while I\/Os are in
\nflight, a response can be posted but its send completion is never
\ndelivered before the connection is torn down. As a result
\nnvmet_rdma_send_done() and nvmet_rdma_release_rsp() are never called for
\nthe response, and this leaks the allocated RDMA read\/write context and
\nrequest SGLs.<\/p>\n
These leaks are recreated by running blktests nvme\/061 with the rdma
\ntransport and the siw driver. Kernel kmemleak feature reports them as
\nfollows:<\/p>\n
unreferenced object 0xffff88812bc490c0 (size 32):
\n comm “kworker\/2:1H”, pid 409, jiffies 4307744490
\n backtrace (crc 89afd339):
\n __kmalloc_noprof+0x5f9\/0x890
\n sgl_alloc_order+0x7b\/0x380
\n nvmet_req_alloc_sgls+0x290\/0x4f0 [nvmet]
\n nvmet_rdma_map_sgl_keyed+0x241\/0x12e0 [nvmet_rdma]
\n nvmet_rdma_handle_command+0x73e\/0xb80 [nvmet_rdma]
\n __ib_process_cq+0x149\/0x4c0 [ib_core]
\n ib_cq_poll_work+0x49\/0x160 [ib_core]
\n process_one_work+0x8b2\/0x1640
\n worker_thread+0x5fd\/0xfe0
\n kthread+0x367\/0x460
\n ret_from_fork+0x655\/0x9d0
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
unreferenced object 0xffff88814bd05e80 (size 64):
\n comm “kworker\/3:1H”, pid 148, jiffies 4295195428
\n backtrace (crc e35510cb):
\n __kmalloc_noprof+0x5f9\/0x890
\n rdma_rw_ctx_init+0x333\/0x1fa0 [ib_core]
\n nvmet_rdma_map_sgl_keyed+0x5c8\/0x12e0 [nvmet_rdma]
\n nvmet_rdma_handle_command+0x73e\/0xb80 [nvmet_rdma]
\n __ib_process_cq+0x149\/0x4c0 [ib_core]
\n ib_cq_poll_work+0x49\/0x160 [ib_core]
\n process_one_work+0x8b2\/0x1640
\n worker_thread+0x5fd\/0xfe0
\n kthread+0x367\/0x460
\n ret_from_fork+0x655\/0x9d0
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
To avoid the memory leaks, reclaim the memory of the in-flight responses
\nwhen the queue QP is torn down. Call nvmet_rdma_free_rsp_resources()
\nthat frees up the RDMA read\/write context and the request SGLs of such
\nresponses.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet-rdma: fix response resource leak on queue teardown<\/p>\n
When an nvme target with rdma transport is removed while I\/Os are in
\nflig<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26008","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26008","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}