Linux kernel RDMA core + mlx5_ib (ib_uverbs_ex_create_flow, flow steering rule creation): The port number a tenant

Impact

The port number a tenant supplies when creating an RDMA flow steering rule was never validated against the device's real port count before being handed to the driver. Flow steering is the mechanism that decides which packets land in which tenant's queue pair, so an unvalidated port index in the rule-creation path is both a kernel crash primitive (the mlx5_ib oops in the report) and a reason to distrust the boundary that is supposed to keep one tenant's traffic out of another's receive queues.

Who can reach it

Local ioctl on /dev/infiniband/uverbs* by any process allowed to create flow rules - which is any RDMA-capable tenant container. Unprivileged.

What to do

Kernel update moving port validation into the core create_flow handler. No configuration workaround; RDMA flow steering cannot be selectively disabled without breaking RoCE traffic classification.

References