Executive brief
The Linux kernel's mlx5 Ethernet driver has a memory leak in its precision time protocol (PTP) implementation. During PTP clock resynchronization operations, socket buffers (SKBs) are improperly freed, causing memory to accumulate and eventually exhaust system resources, potentially leading to service degradation or system instability on servers using Mellanox network cards.
Technical details
This is a memory leak vulnerability in the mlx5 driver's PTP timestamp queue handling. The vulnerability has two root causes: (1) SKBs popped from the FIFO during PTP resync were never freed, and (2) an integer promotion bug in mlx5e_skb_fifo_has_room() where u16 counters are subtracted and promoted to int, causing incorrect room checks when the producer counter wraps around before the consumer counter, resulting in negative values. The fix adds napi_consume_skb() calls in the resync path and casts the pointer arithmetic result explicitly to u16. This is a kernel-space memory management issue affecting systems running the affected mlx5 driver code; no authentication or network reachability is required as it triggers during normal PTP resynchronization operations.
Affected products
- Linux Linux kernel multiple versions (fix backported to stable branches)
Timeline
- 2023-02-02: disclosed: Patch submitted by Vadim Fedorenko (commit e435941b1da1a0be4ff8a7ae425774c76a5ac514)
- 2023-03-11: patched: Fix merged into stable kernel branches by Greg Kroah-Hartman