Linux kernel (drivers/infiniband/hw/hfi1): The driver drops the last reference on a process's memory-descriptor

Impact

The driver drops the last reference on a process's memory-descriptor structure and then keeps using it while unpinning pages. A newly started process can be handed that same structure, so one tenant's cleanup corrupts another running task's address-space state - the reported symptoms include a mangled mmap lock leading to a system-wide hang.

Who can reach it

A tenant with the hfi1 character device in its container, doing pinned-memory RDMA (typical MPI workload), that exits or aborts abruptly while page unpinning is still in flight - an MPI_Abort is the documented trigger, so the tenant controls the timing. Requires hfi1 hardware (Intel Omni-Path).

What to do

Update to 5.10 or later per the record, or apply the listed stable commits on your branch. Interim: keep the hfi1 device node out of untrusted containers; there is no runtime toggle that closes the race.

References