linux-cve-announce - CVE-2025-37867: RDMA/core: Silence oversized kvmalloc() warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025050958-CVE-2025-37867-aa7b@gregkh>
Date: Fri,  9 May 2025 08:44:01 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-37867: RDMA/core: Silence oversized kvmalloc() warning

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Silence oversized kvmalloc() warning

syzkaller triggered an oversized kvmalloc() warning.
Silence it by adding __GFP_NOWARN.

syzkaller log:
 WARNING: CPU: 7 PID: 518 at mm/util.c:665 __kvmalloc_node_noprof+0x175/0x180
 CPU: 7 UID: 0 PID: 518 Comm: c_repro Not tainted 6.11.0-rc6+ #6
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 RIP: 0010:__kvmalloc_node_noprof+0x175/0x180
 RSP: 0018:ffffc90001e67c10 EFLAGS: 00010246
 RAX: 0000000000000100 RBX: 0000000000000400 RCX: ffffffff8149d46b
 RDX: 0000000000000000 RSI: ffff8881030fae80 RDI: 0000000000000002
 RBP: 000000712c800000 R08: 0000000000000100 R09: 0000000000000000
 R10: ffffc90001e67c10 R11: 0030ae0601000000 R12: 0000000000000000
 R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000
 FS:  00007fde79159740(0000) GS:ffff88813bdc0000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000020000180 CR3: 0000000105eb4005 CR4: 00000000003706b0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 Call Trace:
  <TASK>
  ib_umem_odp_get+0x1f6/0x390
  mlx5_ib_reg_user_mr+0x1e8/0x450
  ib_uverbs_reg_mr+0x28b/0x440
  ib_uverbs_write+0x7d3/0xa30
  vfs_write+0x1ac/0x6c0
  ksys_write+0x134/0x170
  ? __sanitizer_cov_trace_pc+0x1c/0x50
  do_syscall_64+0x50/0x110
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

The Linux kernel CVE team has assigned CVE-2025-37867 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4 with commit 37824952dc8fcd96e5c5a1ce9abf3f0ba09b1e5e and fixed in 5.10.237 with commit f94ac90ce7bd6f9266ad0d99044ed86e8d1416c1
	Issue introduced in 5.4 with commit 37824952dc8fcd96e5c5a1ce9abf3f0ba09b1e5e and fixed in 5.15.181 with commit 791daf8240cedf27af8794038ae1d32ef643bce6
	Issue introduced in 5.4 with commit 37824952dc8fcd96e5c5a1ce9abf3f0ba09b1e5e and fixed in 6.1.135 with commit 6c588e9afbab240c921f936cb676dac72e2e2b66
	Issue introduced in 5.4 with commit 37824952dc8fcd96e5c5a1ce9abf3f0ba09b1e5e and fixed in 6.6.88 with commit ae470d06320dea4002d441784d691f0a26b4322d
	Issue introduced in 5.4 with commit 37824952dc8fcd96e5c5a1ce9abf3f0ba09b1e5e and fixed in 6.12.25 with commit 0d81bb58a203ad5f4044dc18cfbc230c194f650a
	Issue introduced in 5.4 with commit 37824952dc8fcd96e5c5a1ce9abf3f0ba09b1e5e and fixed in 6.14.4 with commit f476eba25fdf70faa7b19a3e0fb00e65c5b53106
	Issue introduced in 5.4 with commit 37824952dc8fcd96e5c5a1ce9abf3f0ba09b1e5e and fixed in 6.15-rc3 with commit 9a0e6f15029e1a8a21e40f06fd05aa52b7f063de

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-37867
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/infiniband/core/umem_odp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f94ac90ce7bd6f9266ad0d99044ed86e8d1416c1
	https://git.kernel.org/stable/c/791daf8240cedf27af8794038ae1d32ef643bce6
	https://git.kernel.org/stable/c/6c588e9afbab240c921f936cb676dac72e2e2b66
	https://git.kernel.org/stable/c/ae470d06320dea4002d441784d691f0a26b4322d
	https://git.kernel.org/stable/c/0d81bb58a203ad5f4044dc18cfbc230c194f650a
	https://git.kernel.org/stable/c/f476eba25fdf70faa7b19a3e0fb00e65c5b53106
	https://git.kernel.org/stable/c/9a0e6f15029e1a8a21e40f06fd05aa52b7f063de