Linux kernel (drivers/infiniband/sw/rxe): A null-pointer dereference panics the node whenever queue-pair creation fails

Impact

A null-pointer dereference panics the node whenever queue-pair creation fails because the underlying UDP socket could not be set up. Cleanup runs before the pointer check, so the failure path itself is the crash - one tenant's failed QP takes the host away from every other tenant.

Who can reach it

Reachable two ways on a node with soft-RoCE (rdma_rxe) loaded: a tenant container holding /dev/infiniband/uverbs* calling create_qp, or an in-kernel consumer - the upstream report is a plain 'mount.cifs' over RDMA. Socket creation is made to fail through namespace/resource conditions the caller influences. Unprivileged; rxe only.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: blacklist/unload rdma_rxe if soft-RoCE is not required, and avoid SMB-Direct/RDMA mounts from untrusted contexts until patched.

References