CVE-2025-22010

RDMA/hns: Fix soft lockup during bt pages loop

State: Published
Severity: Not scored
Published: Apr 8, 2025
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix soft lockup during bt pages loop

Driver runs a for-loop when allocating bt pages and mapping them with buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated, it may require a considerable loop count. This will lead to soft lockup:

watchdog: BUG: soft lockup - CPU#27 stuck for 22s! ... Call trace: hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2] hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2] hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2] alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2] hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x118/0x290

watchdog: BUG: soft lockup - CPU#35 stuck for 23s! ... Call trace: hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2] mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2] hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2] alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2] hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x120/0x2bc

Add a cond_resched() to fix soft lockup during these loops. In order not to affect the allocation performance of normal-size buffer, set the loop count of a 100GB MR as the threshold to call cond_resched().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	38389eaa4db192648916464b60f6086d6bbaa6de to before 461eb4ddede266df8f181f578732bb01742c3fd6Affected 38389eaa4db192648916464b60f6086d6bbaa6de to before efe544462fc0b499725364f90bd0f8bbf16f861aAffected 38389eaa4db192648916464b60f6086d6bbaa6de to before 4104b0023ff66b5df900d23dbf38310893deca79Affected 38389eaa4db192648916464b60f6086d6bbaa6de to before 975355faba56c0751292ed15a90c3e2c7dc0aad6Affected 38389eaa4db192648916464b60f6086d6bbaa6de to before 13a52f6c9ff99f7d88f81da535cb4e85eade662bAffected 38389eaa4db192648916464b60f6086d6bbaa6de to before 9ab20fec7a1ce3057ad86afd27bfd08420b7cd11Affected 38389eaa4db192648916464b60f6086d6bbaa6de to before 25655580136de59ec89f09089dd28008ea440fc9Affected
LinuxLinux	5.3Affected before 5.3Not affected 5.10.236 through 5.10.Not affected 5.15.180 through 5.15.Not affected 6.1.132 through 6.1.Not affected 6.6.85 through 6.6.Not affected 6.12.21 through 6.12.Not affected 6.13.9 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

38389eaa4db192648916464b60f6086d6bbaa6de to before 461eb4ddede266df8f181f578732bb01742c3fd6Affected
38389eaa4db192648916464b60f6086d6bbaa6de to before efe544462fc0b499725364f90bd0f8bbf16f861aAffected
38389eaa4db192648916464b60f6086d6bbaa6de to before 4104b0023ff66b5df900d23dbf38310893deca79Affected
38389eaa4db192648916464b60f6086d6bbaa6de to before 975355faba56c0751292ed15a90c3e2c7dc0aad6Affected
38389eaa4db192648916464b60f6086d6bbaa6de to before 13a52f6c9ff99f7d88f81da535cb4e85eade662bAffected
38389eaa4db192648916464b60f6086d6bbaa6de to before 9ab20fec7a1ce3057ad86afd27bfd08420b7cd11Affected
38389eaa4db192648916464b60f6086d6bbaa6de to before 25655580136de59ec89f09089dd28008ea440fc9Affected

LinuxLinux

5.3Affected
before 5.3Not affected
5.10.236 through 5.10.*Not affected
5.15.180 through 5.15.*Not affected
6.1.132 through 6.1.*Not affected
6.6.85 through 6.6.*Not affected
6.12.21 through 6.12.*Not affected
6.13.9 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.