Linux kernel (drivers/infiniband/sw/rxe): When soft-RoCE queue-pair initialisation fails, the QP structure is left full

Impact

When soft-RoCE queue-pair initialisation fails, the QP structure is left full of uninitialised garbage and the cleanup path treats that garbage as valid pointers - refcount underflow and use-after-free on freed or bogus addresses. Found by syzkaller from unprivileged userspace, so it is a proven reachable memory-corruption primitive.

Who can reach it

An unprivileged process on any node with the rdma_rxe module loaded issues QP creation calls that fail partway (bad attributes or resource pressure). No hardware HCA, no fabric peer, no host root.

What to do

No fixed version is listed in the record - take the stable kernel carrying c65391dd9f0a (or 6a8086a42dfb / f3783c415bf6) and reboot. Interim: unload and blacklist rdma_rxe where soft-RoCE is not required.

References