linux-cve-announce - CVE-2023-54274: RDMA/srpt: Add a check for valid 'mad

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025123002-CVE-2023-54274-79a7@gregkh>
Date: Tue, 30 Dec 2025 13:20:40 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54274: RDMA/srpt: Add a check for valid 'mad_agent' pointer

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: Add a check for valid 'mad_agent' pointer

When unregistering MAD agent, srpt module has a non-null check
for 'mad_agent' pointer before invoking ib_unregister_mad_agent().
This check can pass if 'mad_agent' variable holds an error value.
The 'mad_agent' can have an error value for a short window when
srpt_add_one() and srpt_remove_one() is executed simultaneously.

In srpt module, added a valid pointer check for 'sport->mad_agent'
before unregistering MAD agent.

This issue can hit when RoCE driver unregisters ib_device

Stack Trace:
------------
BUG: kernel NULL pointer dereference, address: 000000000000004d
PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0
Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P
Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020
Workqueue: bnxt_re bnxt_re_task [bnxt_re]
RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40
Call Trace:
  ib_unregister_mad_agent+0x46/0x2f0 [ib_core]
  IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
  ? __schedule+0x20b/0x560
  srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt]
  srpt_remove_one+0x20/0x150 [ib_srpt]
  remove_client_context+0x88/0xd0 [ib_core]
  bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex
  disable_device+0x8a/0x160 [ib_core]
  bond0: active interface up!
  ? kernfs_name_hash+0x12/0x80
 (NULL device *): Bonding Info Received: rdev: 000000006c0b8247
  __ib_unregister_device+0x42/0xb0 [ib_core]
 (NULL device *):         Master: mode: 4 num_slaves:2
  ib_unregister_device+0x22/0x30 [ib_core]
 (NULL device *):         Slave: id: 105069936 name:p2p1 link:0 state:0
  bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re]
  bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re]

The Linux kernel CVE team has assigned CVE-2023-54274 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.3 with commit a42d985bd5b234da8b61347a78dc3057bf7bb94d and fixed in 5.10.180 with commit 8ec6acdb9b6a80eeb13e778dfedb5d72a88f14fe
	Issue introduced in 3.3 with commit a42d985bd5b234da8b61347a78dc3057bf7bb94d and fixed in 5.15.111 with commit 00cc21e32ea1b8ebbabf5d645da9378d986bf8ba
	Issue introduced in 3.3 with commit a42d985bd5b234da8b61347a78dc3057bf7bb94d and fixed in 6.1.28 with commit 4323aaedeba32076e652aad056afd7885bb96bb7
	Issue introduced in 3.3 with commit a42d985bd5b234da8b61347a78dc3057bf7bb94d and fixed in 6.2.15 with commit 5f6ef2a574b0e0e0ea46ed0022575442df9d0bf9
	Issue introduced in 3.3 with commit a42d985bd5b234da8b61347a78dc3057bf7bb94d and fixed in 6.3.2 with commit b713623bfef8cb1df9c769a3887fa10db63d1c54
	Issue introduced in 3.3 with commit a42d985bd5b234da8b61347a78dc3057bf7bb94d and fixed in 6.4 with commit eca5cd9474cd26d62f9756f536e2e656d3f62f3a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54274
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/infiniband/ulp/srpt/ib_srpt.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8ec6acdb9b6a80eeb13e778dfedb5d72a88f14fe
	https://git.kernel.org/stable/c/00cc21e32ea1b8ebbabf5d645da9378d986bf8ba
	https://git.kernel.org/stable/c/4323aaedeba32076e652aad056afd7885bb96bb7
	https://git.kernel.org/stable/c/5f6ef2a574b0e0e0ea46ed0022575442df9d0bf9
	https://git.kernel.org/stable/c/b713623bfef8cb1df9c769a3887fa10db63d1c54
	https://git.kernel.org/stable/c/eca5cd9474cd26d62f9756f536e2e656d3f62f3a