CVE-2025-38373 (GCVE-0-2025-38373)
Vulnerability from cvelistv5
Published
2025-07-25 12:53
Modified
2025-07-28 04:20
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix potential deadlock in MR deregistration The issue arises when kzalloc() is invoked while holding umem_mutex or any other lock acquired under umem_mutex. This is problematic because kzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke mmu_notifier_invalidate_range_start(). This function can lead to mlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again, resulting in a deadlock. The problematic flow: CPU0 | CPU1 ---------------------------------------|------------------------------------------------ mlx5_ib_dereg_mr() | → revoke_mr() | → mutex_lock(&umem_odp->umem_mutex) | | mlx5_mkey_cache_init() | → mutex_lock(&dev->cache.rb_lock) | → mlx5r_cache_create_ent_locked() | → kzalloc(GFP_KERNEL) | → fs_reclaim() | → mmu_notifier_invalidate_range_start() | → mlx5_ib_invalidate_range() | → mutex_lock(&umem_odp->umem_mutex) → cache_ent_find_and_store() | → mutex_lock(&dev->cache.rb_lock) | Additionally, when kzalloc() is called from within cache_ent_find_and_store(), we encounter the same deadlock due to re-acquisition of umem_mutex. Solve by releasing umem_mutex in dereg_mr() after umr_revoke_mr() and before acquiring rb_lock. This ensures that we don't hold umem_mutex while performing memory allocations that could trigger the reclaim path. This change prevents the deadlock by ensuring proper lock ordering and avoiding holding locks during memory allocation operations that could trigger the reclaim path. The following lockdep warning demonstrates the deadlock: python3/20557 is trying to acquire lock: ffff888387542128 (&umem_odp->umem_mutex){+.+.}-{4:4}, at: mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib] but task is already holding lock: ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: unmap_vmas+0x7b/0x1a0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}: fs_reclaim_acquire+0x60/0xd0 mem_cgroup_css_alloc+0x6f/0x9b0 cgroup_init_subsys+0xa4/0x240 cgroup_init+0x1c8/0x510 start_kernel+0x747/0x760 x86_64_start_reservations+0x25/0x30 x86_64_start_kernel+0x73/0x80 common_startup_64+0x129/0x138 -> #2 (fs_reclaim){+.+.}-{0:0}: fs_reclaim_acquire+0x91/0xd0 __kmalloc_cache_noprof+0x4d/0x4c0 mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib] mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib] mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib] __mlx5_ib_add+0x4b/0x190 [mlx5_ib] mlx5r_probe+0xd9/0x320 [mlx5_ib] auxiliary_bus_probe+0x42/0x70 really_probe+0xdb/0x360 __driver_probe_device+0x8f/0x130 driver_probe_device+0x1f/0xb0 __driver_attach+0xd4/0x1f0 bus_for_each_dev+0x79/0xd0 bus_add_driver+0xf0/0x200 driver_register+0x6e/0xc0 __auxiliary_driver_register+0x6a/0xc0 do_one_initcall+0x5e/0x390 do_init_module+0x88/0x240 init_module_from_file+0x85/0xc0 idempotent_init_module+0x104/0x300 __x64_sys_finit_module+0x68/0xc0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 -> #1 (&dev->cache.rb_lock){+.+.}-{4:4}: __mutex_lock+0x98/0xf10 __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib] mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib] ib_dereg_mr_user+0x85/0x1f0 [ib_core] ---truncated---
References
Impacted products
Vendor Product Version
Linux Linux Version: b13d32786acabf70a7b04ed24b7468fc3c82977c
Version: abb604a1a9c87255c7a6f3b784410a9707baf467
Version: abb604a1a9c87255c7a6f3b784410a9707baf467
Version: 5297f5ddffef47b94172ab0d3d62270002a3dcc1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "beb89ada5715e7bd1518c58863eedce89ec051a7",
              "status": "affected",
              "version": "b13d32786acabf70a7b04ed24b7468fc3c82977c",
              "versionType": "git"
            },
            {
              "lessThan": "727eb1be65a370572edf307558ec3396b8573156",
              "status": "affected",
              "version": "abb604a1a9c87255c7a6f3b784410a9707baf467",
              "versionType": "git"
            },
            {
              "lessThan": "2ed25aa7f7711f508b6120e336f05cd9d49943c0",
              "status": "affected",
              "version": "abb604a1a9c87255c7a6f3b784410a9707baf467",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5297f5ddffef47b94172ab0d3d62270002a3dcc1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.12.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix potential deadlock in MR deregistration\n\nThe issue arises when kzalloc() is invoked while holding umem_mutex or\nany other lock acquired under umem_mutex. This is problematic because\nkzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke\nmmu_notifier_invalidate_range_start(). This function can lead to\nmlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again,\nresulting in a deadlock.\n\nThe problematic flow:\n             CPU0                      |              CPU1\n---------------------------------------|------------------------------------------------\nmlx5_ib_dereg_mr()                     |\n \u2192 revoke_mr()                         |\n   \u2192 mutex_lock(\u0026umem_odp-\u003eumem_mutex) |\n                                       | mlx5_mkey_cache_init()\n                                       |  \u2192 mutex_lock(\u0026dev-\u003ecache.rb_lock)\n                                       |  \u2192 mlx5r_cache_create_ent_locked()\n                                       |    \u2192 kzalloc(GFP_KERNEL)\n                                       |      \u2192 fs_reclaim()\n                                       |        \u2192 mmu_notifier_invalidate_range_start()\n                                       |          \u2192 mlx5_ib_invalidate_range()\n                                       |            \u2192 mutex_lock(\u0026umem_odp-\u003eumem_mutex)\n   \u2192 cache_ent_find_and_store()        |\n     \u2192 mutex_lock(\u0026dev-\u003ecache.rb_lock) |\n\nAdditionally, when kzalloc() is called from within\ncache_ent_find_and_store(), we encounter the same deadlock due to\nre-acquisition of umem_mutex.\n\nSolve by releasing umem_mutex in dereg_mr() after umr_revoke_mr()\nand before acquiring rb_lock. This ensures that we don\u0027t hold\numem_mutex while performing memory allocations that could trigger\nthe reclaim path.\n\nThis change prevents the deadlock by ensuring proper lock ordering and\navoiding holding locks during memory allocation operations that could\ntrigger the reclaim path.\n\nThe following lockdep warning demonstrates the deadlock:\n\n python3/20557 is trying to acquire lock:\n ffff888387542128 (\u0026umem_odp-\u003eumem_mutex){+.+.}-{4:4}, at:\n mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib]\n\n but task is already holding lock:\n ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at:\n unmap_vmas+0x7b/0x1a0\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -\u003e #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:\n       fs_reclaim_acquire+0x60/0xd0\n       mem_cgroup_css_alloc+0x6f/0x9b0\n       cgroup_init_subsys+0xa4/0x240\n       cgroup_init+0x1c8/0x510\n       start_kernel+0x747/0x760\n       x86_64_start_reservations+0x25/0x30\n       x86_64_start_kernel+0x73/0x80\n       common_startup_64+0x129/0x138\n\n -\u003e #2 (fs_reclaim){+.+.}-{0:0}:\n       fs_reclaim_acquire+0x91/0xd0\n       __kmalloc_cache_noprof+0x4d/0x4c0\n       mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib]\n       mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib]\n       mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib]\n       __mlx5_ib_add+0x4b/0x190 [mlx5_ib]\n       mlx5r_probe+0xd9/0x320 [mlx5_ib]\n       auxiliary_bus_probe+0x42/0x70\n       really_probe+0xdb/0x360\n       __driver_probe_device+0x8f/0x130\n       driver_probe_device+0x1f/0xb0\n       __driver_attach+0xd4/0x1f0\n       bus_for_each_dev+0x79/0xd0\n       bus_add_driver+0xf0/0x200\n       driver_register+0x6e/0xc0\n       __auxiliary_driver_register+0x6a/0xc0\n       do_one_initcall+0x5e/0x390\n       do_init_module+0x88/0x240\n       init_module_from_file+0x85/0xc0\n       idempotent_init_module+0x104/0x300\n       __x64_sys_finit_module+0x68/0xc0\n       do_syscall_64+0x6d/0x140\n       entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n -\u003e #1 (\u0026dev-\u003ecache.rb_lock){+.+.}-{4:4}:\n       __mutex_lock+0x98/0xf10\n       __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib]\n       mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib]\n       ib_dereg_mr_user+0x85/0x1f0 [ib_core]\n  \n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:20:18.459Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/beb89ada5715e7bd1518c58863eedce89ec051a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/727eb1be65a370572edf307558ec3396b8573156"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ed25aa7f7711f508b6120e336f05cd9d49943c0"
        }
      ],
      "title": "IB/mlx5: Fix potential deadlock in MR deregistration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38373",
    "datePublished": "2025-07-25T12:53:16.082Z",
    "dateReserved": "2025-04-16T04:51:24.009Z",
    "dateUpdated": "2025-07-28T04:20:18.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38373\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:26.283\",\"lastModified\":\"2025-07-25T15:29:19.837\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nIB/mlx5: Fix potential deadlock in MR deregistration\\n\\nThe issue arises when kzalloc() is invoked while holding umem_mutex or\\nany other lock acquired under umem_mutex. This is problematic because\\nkzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke\\nmmu_notifier_invalidate_range_start(). This function can lead to\\nmlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again,\\nresulting in a deadlock.\\n\\nThe problematic flow:\\n             CPU0                      |              CPU1\\n---------------------------------------|------------------------------------------------\\nmlx5_ib_dereg_mr()                     |\\n \u2192 revoke_mr()                         |\\n   \u2192 mutex_lock(\u0026umem_odp-\u003eumem_mutex) |\\n                                       | mlx5_mkey_cache_init()\\n                                       |  \u2192 mutex_lock(\u0026dev-\u003ecache.rb_lock)\\n                                       |  \u2192 mlx5r_cache_create_ent_locked()\\n                                       |    \u2192 kzalloc(GFP_KERNEL)\\n                                       |      \u2192 fs_reclaim()\\n                                       |        \u2192 mmu_notifier_invalidate_range_start()\\n                                       |          \u2192 mlx5_ib_invalidate_range()\\n                                       |            \u2192 mutex_lock(\u0026umem_odp-\u003eumem_mutex)\\n   \u2192 cache_ent_find_and_store()        |\\n     \u2192 mutex_lock(\u0026dev-\u003ecache.rb_lock) |\\n\\nAdditionally, when kzalloc() is called from within\\ncache_ent_find_and_store(), we encounter the same deadlock due to\\nre-acquisition of umem_mutex.\\n\\nSolve by releasing umem_mutex in dereg_mr() after umr_revoke_mr()\\nand before acquiring rb_lock. This ensures that we don\u0027t hold\\numem_mutex while performing memory allocations that could trigger\\nthe reclaim path.\\n\\nThis change prevents the deadlock by ensuring proper lock ordering and\\navoiding holding locks during memory allocation operations that could\\ntrigger the reclaim path.\\n\\nThe following lockdep warning demonstrates the deadlock:\\n\\n python3/20557 is trying to acquire lock:\\n ffff888387542128 (\u0026umem_odp-\u003eumem_mutex){+.+.}-{4:4}, at:\\n mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib]\\n\\n but task is already holding lock:\\n ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at:\\n unmap_vmas+0x7b/0x1a0\\n\\n which lock already depends on the new lock.\\n\\n the existing dependency chain (in reverse order) is:\\n\\n -\u003e #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:\\n       fs_reclaim_acquire+0x60/0xd0\\n       mem_cgroup_css_alloc+0x6f/0x9b0\\n       cgroup_init_subsys+0xa4/0x240\\n       cgroup_init+0x1c8/0x510\\n       start_kernel+0x747/0x760\\n       x86_64_start_reservations+0x25/0x30\\n       x86_64_start_kernel+0x73/0x80\\n       common_startup_64+0x129/0x138\\n\\n -\u003e #2 (fs_reclaim){+.+.}-{0:0}:\\n       fs_reclaim_acquire+0x91/0xd0\\n       __kmalloc_cache_noprof+0x4d/0x4c0\\n       mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib]\\n       mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib]\\n       mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib]\\n       __mlx5_ib_add+0x4b/0x190 [mlx5_ib]\\n       mlx5r_probe+0xd9/0x320 [mlx5_ib]\\n       auxiliary_bus_probe+0x42/0x70\\n       really_probe+0xdb/0x360\\n       __driver_probe_device+0x8f/0x130\\n       driver_probe_device+0x1f/0xb0\\n       __driver_attach+0xd4/0x1f0\\n       bus_for_each_dev+0x79/0xd0\\n       bus_add_driver+0xf0/0x200\\n       driver_register+0x6e/0xc0\\n       __auxiliary_driver_register+0x6a/0xc0\\n       do_one_initcall+0x5e/0x390\\n       do_init_module+0x88/0x240\\n       init_module_from_file+0x85/0xc0\\n       idempotent_init_module+0x104/0x300\\n       __x64_sys_finit_module+0x68/0xc0\\n       do_syscall_64+0x6d/0x140\\n       entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\n -\u003e #1 (\u0026dev-\u003ecache.rb_lock){+.+.}-{4:4}:\\n       __mutex_lock+0x98/0xf10\\n       __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib]\\n       mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib]\\n       ib_dereg_mr_user+0x85/0x1f0 [ib_core]\\n  \\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ed25aa7f7711f508b6120e336f05cd9d49943c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/727eb1be65a370572edf307558ec3396b8573156\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/beb89ada5715e7bd1518c58863eedce89ec051a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.