fkie_cve-2022-50135
Vulnerability from fkie_nvd
Published
2025-06-18 11:15
Modified
2025-06-18 13:47
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup The function rxe_create_qp calls rxe_qp_from_init. If some error occurs, the error handler of function rxe_qp_from_init will set both scq and rcq to NULL. Then rxe_create_qp calls rxe_put to handle qp. In the end, rxe_qp_do_cleanup is called by rxe_put. rxe_qp_do_cleanup directly accesses scq and rcq before checking them. This will cause null-ptr-deref error. The call graph is as below: rxe_create_qp { ... rxe_qp_from_init { ... err1: ... qp->rcq = NULL; <---rcq is set to NULL qp->scq = NULL; <---scq is set to NULL ... } qp_init: rxe_put{ ... rxe_qp_do_cleanup { ... atomic_dec(&qp->scq->num_wq); <--- scq is accessed ... atomic_dec(&qp->rcq->num_wq); <--- rcq is accessed } }
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup\n\nThe function rxe_create_qp calls rxe_qp_from_init. If some error\noccurs, the error handler of function rxe_qp_from_init will set\nboth scq and rcq to NULL.\n\nThen rxe_create_qp calls rxe_put to handle qp. In the end,\nrxe_qp_do_cleanup is called by rxe_put. rxe_qp_do_cleanup directly\naccesses scq and rcq before checking them. This will cause\nnull-ptr-deref error.\n\nThe call graph is as below:\n\nrxe_create_qp {\n  ...\n  rxe_qp_from_init {\n    ...\n  err1:\n    ...\n    qp-\u003ercq = NULL;  \u003c---rcq is set to NULL\n    qp-\u003escq = NULL;  \u003c---scq is set to NULL\n    ...\n  }\n\nqp_init:\n  rxe_put{\n    ...\n    rxe_qp_do_cleanup {\n      ...\n      atomic_dec(\u0026qp-\u003escq-\u003enum_wq); \u003c--- scq is accessed\n      ...\n      atomic_dec(\u0026qp-\u003ercq-\u003enum_wq); \u003c--- rcq is accessed\n    }\n}"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: Correcci\u00f3n BUG: KASAN: null-ptr-deref en rxe_qp_do_cleanup La funci\u00f3n rxe_create_qp llama a rxe_qp_from_init. Si ocurre alg\u00fan error, el controlador de errores de la funci\u00f3n rxe_qp_from_init establecer\u00e1 tanto scq como rcq en NULL. Luego, rxe_create_qp llama a rxe_put para manejar qp. Al final, rxe_put llama a rxe_qp_do_cleanup. rxe_qp_do_cleanup accede directamente a scq y rcq antes de verificarlos. Esto causar\u00e1 un error null-ptr-deref. El gr\u00e1fico de llamadas es el siguiente: rxe_create_qp { ... rxe_qp_from_init { ... err1: ... qp-\u0026gt;rcq = NULL; \u0026lt;---rcq se establece en NULL qp-\u0026gt;scq = NULL; \u0026lt;---scq se establece en NULL ... } qp_init: rxe_put{ ... rxe_qp_do_cleanup { ... atomic_dec(\u0026amp;qp-\u0026gt;scq-\u0026gt;num_wq); \u0026lt;--- se accede a scq ... atomic_dec(\u0026amp;qp-\u0026gt;rcq-\u0026gt;num_wq); \u0026lt;--- se accede a rcq } }"
    }
  ],
  "id": "CVE-2022-50135",
  "lastModified": "2025-06-18T13:47:40.833",
  "metrics": {},
  "published": "2025-06-18T11:15:43.387",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.