Linux kernel (drivers/infiniband/core): The core set the send and receive completion-queue pointers on a queue pair

Impact

The core set the send and receive completion-queue pointers on a queue pair only after handing it to the driver, so when driver-side creation fails the destroy path walks unset pointers and writes into freed memory. The upstream report is a KASAN use-after-free reached from an ordinary userspace program on mlx5 - the exact NIC under most GPU clusters.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* issues an ibv_create_qp that the hardware driver rejects. Failing QP creation is trivially arranged with bad attributes or resource exhaustion, so this is a one-syscall reach from inside a container - no fabric peer, no host root.

What to do

No fixed version is listed in the record - take the stable kernel carrying b70e072feffa (or 6cd7397d01c4) and reboot. Interim: remove /dev/infiniband/* from untrusted containers.

References