CVE-2021-47261

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/mlx5: Fix initializing CQ fragments buffer

The function init_cq_frag_buf() can be called to initialize the current CQ

fragments buffer cq->buf, or the temporary cq->resize_buf that is filled

during CQ resize operation.

However, the offending commit started to use function get_cqe() for

getting the CQEs, the issue with this change is that get_cqe() always

returns CQEs from cq->buf, which leads us to initialize the wrong buffer,

and in case of enlarging the CQ we try to access elements beyond the size

of the current cq->buf and eventually hit a kernel panic.

[exception RIP: init_cq_frag_buf+103]

[ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib]

[ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core]

[ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt]

[ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt]

[ffff9f799ddcbe98] llt_rdma_client_conn_thread at f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References