In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Reload only IB representors upon lag disable/enable
On lag disable, the bond IB device along with all of its representors are destroyed, and then the slaves' representors get reloaded.
In case the slave IB representor load fails, the eswitch error flow unloads all representors, including ethernet representors, where the netdevs get detached and removed from lag bond. Such flow is inaccurate as the lag driver is not responsible for loading/unloading ethernet representors. Furthermore, the flow described above begins by holding lag lock to prevent bond changes during disable flow. However, when reaching the ethernet representors detachment from lag, the lag lock is required again, triggering the following deadlock:
Call trace: __switch_to+0xf4/0x148 __schedule+0x2c8/0x7d0 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x28 __mutex_lock.isra.13+0x2b8/0x570 __mutex_lock_slowpath+0x1c/0x28 mutex_lock+0x4c/0x68 mlx5_lag_remove_netdev+0x3c/0x1a0 [mlx5_core] mlx5e_uplink_rep_disable+0x70/0xa0 [mlx5_core] mlx5e_detach_netdev+0x6c/0xb0 [mlx5_core] mlx5e_netdev_change_profile+0x44/0x138 [mlx5_core] mlx5e_netdev_attach_nic_profile+0x28/0x38 [mlx5_core] mlx5e_vport_rep_unload+0x184/0x1b8 [mlx5_core] mlx5_esw_offloads_rep_load+0xd8/0xe0 [mlx5_core] mlx5_eswitch_reload_reps+0x74/0xd0 [mlx5_core] mlx5_disable_lag+0x130/0x138 [mlx5_core] mlx5_lag_disable_change+0x6c/0x70 [mlx5_core] // hold ldev->lock mlx5_devlink_eswitch_mode_set+0xc0/0x410 [mlx5_core] devlink_nl_cmd_eswitch_set_doit+0xdc/0x180 genl_family_rcv_msg_doit.isra.17+0xe8/0x138 genl_rcv_msg+0xe4/0x220 netlink_rcv_skb+0x44/0x108 genl_rcv+0x40/0x58 netlink_unicast+0x198/0x268 netlink_sendmsg+0x1d4/0x418 sock_sendmsg+0x54/0x60 __sys_sendto+0xf4/0x120 __arm64_sys_sendto+0x30/0x40 el0_svc_common+0x8c/0x120 do_el0_svc+0x30/0xa0 el0_svc+0x20/0x30 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180
Thus, upon lag enable/disable, load and unload only the IB representors of the slaves preventing the deadlock mentioned above.
While at it, refactor the mlx5_esw_offloads_rep_load() function to have a static helper method for its internal logic, in symmetry with the representor unload design.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | Jun 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-64kb-extraUpgrade kernel-rt-optionalUpgrade dtb-renesasUpgrade dlm-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-debug-develUpgrade kernel-azure-optionalUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade dtb-lgUpgrade kernel-64kbUpgrade kernel-azure-extraUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-azureUpgrade dtb-amazonUpgrade gfs2-kmp-rtUpgrade kernel-debugUpgrade kernel-syms-rtUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debugUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-source-azureUpgrade gfs2-kmp-defaultUpgrade dtb-freescaleUpgrade kernel-zfcpdumpUpgrade kernel-obs-qaUpgrade dtb-amdUpgrade dtb-marvellUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-docsUpgrade kernel-default-develUpgrade cluster-md-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-apmUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-symsUpgrade ocfs2-kmp-rtUpgrade dtb-appleUpgrade kernel-source-rtUpgrade kernel-rtUpgrade kselftests-kmp-defaultUpgrade dtb-caviumUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade dtb-sprdUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade dtb-armUpgrade dlm-kmp-rtUpgrade dtb-qcomUpgrade dtb-allwinnerUpgrade kernel-debug-vdsoUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-default-base-rebuildUpgrade kernel-azureUpgrade dtb-xilinxUpgrade dtb-rockchipUpgrade dtb-amlogicUpgrade ocfs2-kmp-defaultUpgrade kernel-macrosUpgrade cluster-md-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-devel-rtUpgrade dtb-exynosUpgrade dtb-nvidiaUpgrade kernel-kvmsmallUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade kernel-devel-azureUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade kernel-default-optionalUpgrade kernel-azure-livepatch-develUpgrade gfs2-kmp-azureUpgrade kernel-develUpgrade dtb-altera | Jul 10, 2024 | Jun 19, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-azureUpgrade linux-image-oem-24.04Upgrade linux-image-ibmUpgrade linux-image-generic-64kUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-ibm-classicUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-40-genericUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtualUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-6.8.0-1008-gke | Aug 9, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 3, 2025 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub