Linux kernel (drivers/infiniband/sw/rxe): Any tenant that can open an RDMA verbs device can oops the node. A queue-pair

Impact

Any tenant that can open an RDMA verbs device can oops the node. A queue-pair creation that fails part-way unwinds into cleanup code that grabs a spinlock which was never initialized, killing the kernel thread in an unrecoverable state and taking every other tenant sharing the box down with it.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* issues an ordinary create_qp with attributes that make initialization fail (oversized capabilities, exhausted resources). No privilege beyond the device node is required, and the failure is tenant-controlled so it is repeatable rather than a rare race. Only applies where the soft-RoCE driver rdma_rxe is loaded; hardware HCAs do not run this path.

What to do

No fixed release is published in this record - pull the stable fix commits (backported across the 5.x series) or run a current stable kernel. Interim: blacklist/unload rdma_rxe if soft-RoCE is not deliberately in use, and stop mapping /dev/infiniband/* into containers that do not need verbs access.

References