CVE-2025-21886

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix implicit ODP hang on parent deregistration

Fix the destroyunusedimplicitchildmr() to prevent hanging during parent deregistration as of below [1].

Upon entering destroyunusedimplicitchildmr(), the reference count for the implicit MR parent is incremented using: refcountincnot_zero().

A corresponding decrement must be performed if freeimplicitchildmrwork() is not called.

The code has been updated to properly manage the reference count that was incremented.

[1] INFO: task python3:2157 blocked for more than 120 seconds. Not tainted 6.12.0-rc7+ #1633 "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. task:python3 state:D stack:0 pid:2157 tgid:2157 ppid:1685 flags:0x00000000 Call Trace: <TASK> _schedule+0x420/0xd30 schedule+0x47/0x130 _mlx5ibderegmr+0x379/0x5d0 [mlx5ib] ? _pfxautoremovewakefunction+0x10/0x10 ibderegmruser+0x5f/0x120 [ibcore] ? lockrelease+0xc6/0x280 destroyhwidruobject+0x1d/0x60 [ibuverbs] uverbsdestroyuobject+0x58/0x1d0 [ibuverbs] uobjdestroy+0x3f/0x70 [ibuverbs] ibuverbscmdverbs+0x3e4/0xbb0 [ibuverbs] ? _pfxuverbsdestroydefhandler+0x10/0x10 [ibuverbs] ? lockacquire+0xc1/0x2f0 ? ibuverbsioctl+0xcb/0x170 [ibuverbs] ? ibuverbsioctl+0x116/0x170 [ibuverbs] ? lockrelease+0xc6/0x280 ibuverbsioctl+0xe7/0x170 [ibuverbs] ? ibuverbsioctl+0xcb/0x170 [ibuverbs] _x64sysioctl+0x1b0/0xa70 ? kmemcachefree+0x221/0x400 dosyscall64+0x6b/0x140 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7f20f21f017b RSP: 002b:00007ffcfc4a77c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffcfc4a78d8 RCX: 00007f20f21f017b RDX: 00007ffcfc4a78c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffcfc4a78a0 R08: 000056147d125190 R09: 00007f20f1f14c60 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffcfc4a7890 R13: 000000000000001c R14: 000056147d100fc0 R15: 00007f20e365c9d0 </TASK>